XSS in hidden input fields

Published: 16 November 2015 at 11:25 UTC Updated: 14 June 2019 at 12:03 UTC At PortSwigger, we regularly run pre-release builds of Burp Suite against an internal testbed of popular web applications to make sure it's behaving properly. Whilst doing this recently, Liam found a Cross-Site Scripting (XSS) vulnerability in [REDACTED], inside a hidden input element: <input type="hidden" name="redacted"

[ockeghem]

type=hiddenなinput要素にXSSがある場合JavaScriptを起動することは困難だがaccesskeyを用いることでALT+SHIFT+X押下にりJS起動が可能

[efcl]

linkタグの`accesskey`を使ってXSSする例

[sho]

面白いけど、あんまり引っかかってくれそうな気はしないなぁ。

[ya--mada]

ｷﾃﾙ

[msakamoto-sf]

hidden