JS/HTML injection via SSID
jn4kr opened this issue · comments
As you can see it's possible to inject HTML/Javascript in the attack page via the ssid.
Steps to reproduce
- Create a beacon with the tag you wan't to inject as SSID (e.g. <svg onload="alert('1')"/> )
- Select the beacon as target
- Switch to the attack page
Screenshots
@jn4kr ...
Does android even process these WiFi names in the available wifis list ?!
Yeah. But i think it's off topic, so I'll sent you a mail about this topic.
Project is kinda dead but once i really don’t know what to do, i’ll think about it.
We might be able to strip out all HTML code using a REGEX?
Check thsi out: https://code-examples.net/en/q/129e949