Alternative to define in-line javascript expressions

Question

I have been learning web application security penetration testing . The scenario is, there is a cross site scripting vulnerability in a test environment demo web application which is developed for practicing. I have a xss payload which is javascript expressions based :

<div style="width: expression(alert(/XSS/))"></div>

I know the expressions are deprecated since IE 8 .It works fine in IE7. So , when i input above payload , Web app returns with

<div></div>

It rips off all other attributes and values. But when i alter the payload like

<div style="width: expression'(alert(/XSS/))'">

Its not a valid payload means it won't execute. So, i am trying to figure out if there is any alternative to define expression in in-line style attribute like if we can place something else other than single_quote which won't break the code . Or if there is any other way to execute javascript via style attribute.

Courbet

Is there any escaping of your injected input? If not, you can just close the style attribute and tag with "> and inject a <script> tag there. – Taunyataupe

Yes, Escaping is there . – Courbet

Answer 1

expression() is the only way to dynamically specify html node attributes. It takes any valid JScript expression as an argument. So technically there is no way to execute javascript via style attribute on an html node (JScript !== javascript).

The reason this functionality doesn't exist, (or has been deprecated) is because it creates a pretty big security vulnerability. If you want to have dynamic html elements, you'd tackle that with css, specifically through media queries. But if you want to go down this path, try checking out the expression() documentation.

In javascript (JScript as well), () invoke a function. So throwing ' or " after an expression name, before invoking it, is invalid syntax. There's probably something else you can place besides "single_quote" which won't break the code, but you wouldn't place it before the (). Try looking up JScript syntax. Here's one last resource that may help.

Armoire

Thanks for the resources and quite great information. Style attribute is all i have to inject through. I will wait for some more time if someone else can help with it, else will mark your answer as correct and +100. – Courbet