How to make an anchor tag's href invoke an anonymous function?

Question

I'm working on a cross-site scripting attack on an internet forum where links can be put in post like

[url]http://google.com[/url]

which then gets surfaced as

<a href="http://google.com">http://google.com</a>

on the forum's thread. If possible, I want to use the technique of invoking JavaScript functions through the href , ie

<script type="text/javascript"> 
    function sayHello ( )
    {
        alert("Hello");
    }
</script>
<a href="javascript:sayHello()">Clicking here alerts "Hello"</a>

but since I don't have any way of using predefined JavaScript functions, I'm wondering if I can put anonymous functions in there, eg

<a href="javascript:function(){alert('Hellow');}">Clicking here alerts "Hello"</a>

I've tested this out in Notepad with the simple page

<html>
    <head>
    </head>
    <body>
        <div>
            <p>Clicking on <a href="javascript:function(){alert('Hello');}">this</a> will alert "Hello""</p>
        </div>
    </body>
</html>

but it didn't work.

Any suggestions for me?

Answer 1

Use an IIFE :

<a href="javascript:(function(){stuff to do})()">Click here</a>

Although there's not too much difference from doing this without the IIFE, just as top-level JS code:

<a href="javascript:stuff to do">Click here</a>

The only significant difference is that you can declare local variables within the function.

How to make an anchor tag's href invoke an anonymous function?

Question

1 answers

solution1
2 ACCPTED 2015-11-04 22:57:34

How to make an anchor tag's href invoke an anonymous function?

Question

1 answers

solution1 2 ACCPTED 2015-11-04 22:57:34

solution1
2 ACCPTED 2015-11-04 22:57:34