Question

This is a security question.
My boss has asked me to find (and show a prototype) of possible hacks over the site and I am over one.

There is an input box on the page and using URI javascript (also know as void or null script) , I have to include a javascript file and jquery file (for the ease of presentation). The following code did not work.

javascript:{{ 
var e=document.createElement("script"); 
alert("Hello World");
e.src = "http://code.jquery.com/jquery-1.6.2.js";e.type="text/javascript"; 
document.getElementsByTagName("head")[0].appendChild(e);
};}

(After uri encoding) I did get “Hello World” alert box but I was not able to find the script while using ‘inspect element’ in chrome. or otherwise no script ran.

Answer 1

If I understand right – you want to include to add new JavaScript to the page. This is my solution

And about the inspect element – right click on the element and it is the last one of the menu.