Hack Your Form-New vector for Blind XSS

Hello Pentesters,

I’m Youssef A. Mohamed aka GeneralEG
Security Researcher @CESPPA , Cyber Security Engineer @Squnity and SRT Member @Synack

  • Today I’m gonna share a juicy finding with you.

Talking about bypassing a couple of filters to execute malicious javascript codes easily and achieve a Blind Stored XSS.

“I found this issue in a lot of targets so, I will take one of these programs as an example.”

The program is private so let’s call it redacted.com

  • Recently I was testing in this program and after some recon, I found that the website offers a specific service (Create Forms).

How does this service work?
1)Creator User create a form
2)Creator User share the link with visitor
3)Visitor fill the form
4)The filled information will be available for the Form’s Creator at redacted.com/manager/{Form ID}/

So while testing the “Creating form” functions, I’ve found that there’s a Website input

I made a simple form.

Then opened as the form as a visitor.

At the first I tried to bypass it as the basic style:
(thought that if I wrote website.com?” payload it will execute)

So, I entered:

( “ + url encoded + html entities encoded)

Then opened the creator account to see what happened.

But unfortunately, the filter encoded the double quotes.

and noticed that the Link rendered in (a tag)

So, I decided to grab a cup of coffee :”D

  • After a few minutes of deep thinking while drinking my coffee about how I will bypass this one.

I decided to start fuzzing in this input especially.. {Enter Website}

While I’m fuzzing I noticed that the filter accepted test:https://example.com !

then tried javascript:https//evil.com
and it worked :D
“Evil loud laugh”

  • Now I’m sure that there’s XSS here
    but it’s need real website merged with my payload so i wrote this one.


Finally executed!

  • But wait we want to make it Blind XSS to attack the real admins (The best scenario).

So the last payload was:



That’s it!


  • 80% of my targets which have the Website’s input was vulnerable to the same scenario.
  • To make sure that your target is vulnerable to the same problem you need a few steps to make sure:

A. Check if the website is accepting other URI scheme like javascript:https://generaleg0x01.com or not?

B. Check if the website is rendering your https://generaleg0x01.com on HTML ‘a’ tag or not?

  • And in the most similar situations, the same payload will work perfectly.

20 December, 2018: Report Submitted
25 December, 2018: Report Reviewed and Triaged
30 December, 2018: Report Resolved & 800$ Bounty Awarded

Learned lessons:

  • Fuzz as much as you can.
  • Don’t try one technique to bypass the filter to try other techniques.

Happy Hacking!