Concealing XSS Payloads in URL Credentials for Advanced Exploitation
PortSwigger researcher Gareth Heyes details a sophisticated web security technique involving the concealment of malicious payloads within the credentials portion of URLs. Building on Johan Carlsson’s earlier discovery, Heyes explains that browsers like Chrome and Firefox hide these credentials from the address bar, yet they remain accessible via the document.URL property, unlike the location object. This discrepancy allows attackers to extract hidden payloads for Cross-Site Scripting (XSS) attacks. The research highlights that Firefox does not URL-encode single quotes in credentials, facilitating DOM XSS exploitation even when query strings are stripped. Furthermore, the article demonstrates how relative anchor links inherit parent credentials, enabling attackers to manipulate username and password properties. When combined with DOM Clobbering, this technique allows control over JavaScript objects, leading to arbitrary code execution. The findings emphasize significant risks for web applications relying on standard URL parsing, noting that Safari discards such credentials while Chrome restricts sub-resource usage. This analysis provides critical insights for developers and security professionals aiming to mitigate advanced client-side vulnerabilities through better input handling and awareness of browser-specific URL processing behaviors.
Wire timeline
Concealing XSS Payloads in URL Credentials for Advanced Exploitation
PortSwigger researcher Gareth Heyes details a sophisticated web security technique involving the concealment of malicious payloads within the credentials portion of URLs. Building on Johan Carlsson’s earlier discovery, Heyes explains that browsers like Chrome and Firefox hide these credentials from the address bar, yet they remain accessible via the document.URL property, unlike the location object. This discrepancy allows attackers to extract hidden payloads for Cross-Site Scripting (XSS) attacks. The research highlights that Firefox does not URL-encode single quotes in credentials, facilitating DOM XSS exploitation even when query strings are stripped. Furthermore, the article demonstrates how relative anchor links inherit parent credentials, enabling attackers to manipulate username and password properties. When combined with DOM Clobbering, this technique allows control over JavaScript objects, leading to arbitrary code execution. The findings emphasize significant risks for web applications relying on standard URL parsing, noting that Safari discards such credentials while Chrome restricts sub-resource usage. This analysis provides critical insights for developers and security professionals aiming to mitigate advanced client-side vulnerabilities through better input handling and awareness of browser-specific URL processing behaviors.
PortSwigger Research