17

Copy paste following in browser bar,

https://stackoverflow.com/questions/ask?title=test"><script>alert(1)</script>"&tags="></a></div><script>alert(/1/)</script><foo+bar="

or

test link (might work, but not sure)

  • but firefox 3.6 without noscript, executed my xss.
  • opera 11, executed my xss
  • chrome somehow does not execute alert, but UI is broken,

Found out tag description field is not html escaped.

11
  • 1
    Confirmed in Chrome 10 on Windows 7. Great catch.
    – Pekka
    Mar 12 '11 at 18:38
  • 2
    No repro in Chrome 11 dev, but reproduced in Firefox 4's latest nightly. (Windows 7)
    – nyuszika7h
    Mar 12 '11 at 18:40
  • I did get an alert in Chrome 9, Gentoo. Did Chrome add fanciness to detect stuff like this? Mar 12 '11 at 18:49
  • @Michael, I don't know but In html source, there is plain <script tag, but somehow, my chrome 11 also can't get executed somehow.
    – YOU
    Mar 12 '11 at 18:54
  • Does not give an alert in Chrome 10 on Mac OS X.
    – Felix
    Mar 12 '11 at 18:57
  • @Michael I've turned on XSS protection in about:flags, though it disappeared in Chrome 11.
    – nyuszika7h
    Mar 12 '11 at 18:59
  • 1
    @Nyuszika7H, does the bounty imply this still needs fixing?
    – Arjan
    Apr 26 '11 at 20:32
  • @Arjan Nope, I just wanted to give some credit to balpha for that Hacker badge, even if it's not real! :)
    – nyuszika7h
    Apr 27 '11 at 5:21
  • @YOU Confirmed in Firefox 4 on Mac. With NoScript turned on, it's detected at as an XSS attempt as well.
    – Dan Blows
    Apr 27 '11 at 16:30
  • @Blowski, Actually, this supposed to be fixed already. Edit: Checked and confirmed on my firefox with NoScript too. Probably NoScript alerting everything with <script> tag in url
    – YOU
    Apr 27 '11 at 16:31
  • @YOU Yes, just checked with NoScript disabled and it's fine. Good to know that's what NoScript does...
    – Dan Blows
    Apr 27 '11 at 16:38
9
+100

Just imagine it's a real one – it's for you:

Hacker badge

2
  • 2
    cool!, very quick response, thanks, I now like to have that badge :D
    – YOU
    Mar 12 '11 at 18:59
  • 4
    Hm, so alert(false) doesn't count for the Hacker badge?
    – badp
    Mar 13 '11 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .