Loading jscript into img tag
spyware wrote: Actually, there is a way.
http://spysballoon.ath.cx/hack
Open error_image.html
What is http://spysballoon.ath.cx/hack/loader.php for ?
BlaX wrote: What is http://spysballoon.ath.cx/hack/loader.php for ?
I didn't want to bother writing RegEx so I used a loader. You can execute code without it if you use RegEx and add a <script> tag to the page.
system_meltdown wrote: … unless you can use JavaScript's createElement method via the img tag also.
You can. IE6 (and possibly IE7) dislike when you do anything DOM-related inside the body of the doc, but no one with any sense uses that browser anymore.
Most importantly, though, you could just skip the whole iframe bit and just use DOM functions to add a script tag with the src of the external script.
Couldn't you just point to local js function that imports an external one?
something like:
<script type="text/javascript">
function importScript(url){
var tag = document.createElement("script");
tag.type="text/javascript";
tag.src = url;
document.body.appendChild(tag);
}
window.onload = function(){
// imports go here
importScript("foo.js"); // example
};
</script>
Also.. Correct me if I'm wrong but if there's a XSS you can use the script tag to create variables, thus if you inject:
<script type="text/javascript">
var doc=document.open("text/html","replace");
var txt="<html><body><script src='source here'</script></body></html>";
doc.write(txt);
doc.close();
</script>
Edit: Sorry scratch that, that closes the first script tag.. but perhaps there's a way to get around that?.. Anyway it was just an idea.
elmiguel wrote: Couldn't you just point to local js function that imports an external one?
something like: <snip>
Obviously, loading a local js file containing a helper function would be great. Then, of course, there wouldn't be a need for an external script… especially not in the onerror event of an image.
… but this is clearly an XSS question, so no local access.
SaMTHG wrote: I'm wrong but if there's a XSS you can use the script tag to create variables, thus if you inject:
<snip>
Edit: Sorry scratch that, that closes the first script tag.. but perhaps there's a way to get around that? document.write is really a dinosaur nowadays. I can't think of a single reason why anyone should be using it.
The (better) alternative is using DOM functions or, at the very least, hacking something together with document.getElementById / getElementsByName / getElementsByTagName and some lazy innerHTML implementation. In the case of inserting the script tag, you pretty much have to stick to DOM functions. The loader a couple posts up illustrates the concept pretty well.