Adding jQuery and javascript in URI (as null)

Question

This is a security question. My boss has asked me to find (and show a prototype) of possible hacks over the site and I am over one.

There is an input box on the page and using URI javascript (also know as void or null script) , I have to include a javascript file and jquery file (for the ease of presentation). The following code did not work.

javascript:{{ 
var e=document.createElement("script"); 
alert("Hello World");
e.src = "http://code.jquery.com/jquery-1.6.2.js";e.type="text/javascript"; 
document.getElementsByTagName("head")[0].appendChild(e);
};}

(After uri encoding) I did get "Hello World" alert box but I was not able to find the script while using 'inspect element' in chrome. or otherwise no script ran.

Community · Accepted Answer · 2017-05-23 12:27:11Z

1

If I understand right - you want to include to add new JavaScript to the page. This is my solution

And about the inspect element - right click on the element and it is the last one of the menu.

edited May 23, 2017 at 12:27

CommunityBot

11 silver badge

answered Jul 15, 2011 at 14:04

Bakudan

19.5k9 gold badges56 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Bakudan Over a year ago

No, there is no bug - look at the result here

Suraj Over a year ago

well thats wierd cause when I tried it through URI, only twitter was added (maybe it was because I included a local file in the middle).

Collectives™ on Stack Overflow

Adding jQuery and javascript in URI (as null)

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related