XSS in hidden fields via “accesskey” attribute

One of Portswigger Academy’s XSS lessons involves triggering a JS payload when a user presses a key combo, but it doesn’t seem very practical to me. Is there any use case that I’m missing or a better way to do this?

For example, if you’re using chrome and the site has the HTML tag

``` <link rel=“canonical” href=“http://site.com”>

```

You can get Reflected XSS by appending to the URL

``` /?’accesskey=‘X’onclick=‘print()’

```

Resulting in the HTML tag now showing

``` <link rel=“canonical” href=“http://site.com/?” accesskey=“X” onclick=“print()” ‘=“”>

```

Depending on the user’s system, pressing keys like Alt+Shift+X or Alt+X would trigger the JS.

How seriously would a client even take a vulnerability report like this? It sounds very difficult for an attacker to get a user to visit the malicious URL and then press a key combo that could vary

submitted by /u/Agent-BTZ
[link] [comments]

from hacking: security in practice https://ift.tt/hB8o6SG