XSS attack?

[dreamy6477]

I got this warning from vulnona maps website, can anyone tell me if its dangerous or not?

Code: Select all

    NoScript detected a potential Cross-Site Scripting attack

    from https://vulnona.com to https://www.google.com.

    Suspicious data:

    (URL) https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfTb4cUAAAAAGvgpCoQlUSxrz3gO1c7Hh5Q3ydg&co=aHR0cHM6Ly92dWxub25hLmNvbTo0NDM.&hl=en&v=PoyoqOPhxBO7pBk68S4YbpHZ&size=invisible&anchor-ms=20000&execute-ms=30000&copy=function(){ // コピーを作成

    try { return structuredClone(this); }

    catch(e){ return JSON.parse(JSON.stringify(this)); }

    }&keys=function(){ // {} のキー配列

    return Object.keys(this);

    }&cb=c0pkd6fouzqz

This was gpt 5- mini response:

This looks suspicious but not obviously a working XSS payload. Quick analysis:

What NoScript flagged: URL includes parameters with embedded JavaScript-like values: "copy=function(){...}", "keys=function(){...}". That suggests the site (vulnona.com) is supplying JavaScript source in query parameters passed to google.com reCAPTCHA anchor URL — a likely sign of an attempted reflected XSS or unsafe URL-injection.

Are those functions dangerous? The functions shown:

copy tries structuredClone(this) falling back to JSON deep-clone — benign by itself.

keys returns Object.keys(this) — benign.

No explicit eval()/document.write()/innerHTML/XHR/etc. shown here.

Why it’s risky anyway:

Embedding function source into a URL can be used to deliver arbitrary JS if the receiving page later evaluates or injects the parameter into page DOM or into a script context.

If the reCAPTCHA endpoint or any intermediary echoes these parameters into page HTML/JS without proper encoding, an attacker could include code that executes (e.g., adding </script><script>… or calling eval).

The presence of non-alphanumeric characters (curly braces, parentheses, comments, Unicode) indicates someone is attempting to smuggle code, not just harmless data.

Practical conclusion:

The snippet as-is is not an immediately executing payload (no obvious call to eval or DOM insertion), but it is a likely probe or part of an XSS attempt. Treat it as potentially dangerous.

If you control vulnona.com, ensure it never reflects query parameters into pages without proper encoding/escaping and use Content Security Policy and input validation.

If you saw this in browser warnings, avoid interacting with the site and report/blacklist it.

If you want, paste the full exact URL/response context and I can point to exactly which characters or patterns are most dangerous and how an attacker might turn it into executing XSS.

[barbaz]

Can confirm the XSS warning.

URL:

Code: Select all

https://vulnona.com/game/map/

Browser Console messages:

Code: Select all

[NoScript] [InjectionChecker]  
 return JSON.parse(JSON.stringify(this)) /**/
DUMMY_EXPR
 has been flagged as dangerous JS (e()

[NoScript] [InjectionChecker]  JavaScript Injection in ///recaptcha/api2/anchor?ar=1&k=6LfTb4cUAAAAAGvgpCoQlUSxrz3gO1c7Hh5Q3ydg&co=aHR0cHM6Ly92dWxub25hLmNvbTo0NDM.&hl=en&v=PoyoqOPhxBO7pBk68S4YbpHZ&size=invisible&anchor-ms=20000&execute-ms=30000©=function(){// コピーを作成try{ return structuredClone(this); }catch(e){ return JSON.parse(JSON.stringify(this)); }}&keys=function(){// {} のキー配列return Object.keys(this);}&cb=89mu4qk86dwe
function anonymous(
) {
 return JSON.parse(JSON.stringify(this)) /* COMMENT_TERMINATOR */
DUMMY_EXPR
}

[NoScript] [InjectionChecker]  JavaScript Injection in ///recaptcha/api2/anchor?ar=1&k=6LfTb4cUAAAAAGvgpCoQlUSxrz3gO1c7Hh5Q3ydg&co=aHR0cHM6Ly92dWxub25hLmNvbTo0NDM.&hl=en&v=PoyoqOPhxBO7pBk68S4YbpHZ&size=invisible&anchor-ms=20000&execute-ms=30000©=function(){// コピーを作成try{ return structuredClone(this); }catch(e){ return JSON.parse(JSON.stringify(this)); }}&keys=function(){// {} のキー配列return Object.keys(this);}&cb=gj55u2ko4p27
function anonymous(
) {
 return JSON.parse(JSON.stringify(this)) /* COMMENT_TERMINATOR */
DUMMY_EXPR
}

This looks like a real attempt to XSS Google's reCAPTCHA. I've never seen other uses of reCAPTCHA doing anything like this.

Not sure what this XSS is trying to do, so best assume it is dangerous. Definitely block these requests, and consider untrusting and blocking the vulnona site if possible.

[dreamy6477]

Thanks for the reply. What exactly about this is dangerous? Like what can the attacker get from you if there successful? I have already used this website for months before installing noscript and didn't notice anything happen. I only just found out about XSS attacks today.

[barbaz]

Like what can the attacker get from you if there successful?

Without knowing internal details of reCAPTCHA and how vulnerable it is to XSS, no way to be sure. The theoretical maximum would be anything reCAPTCHA might have, for example: access to your Google account if you're signed in to Google, or trying to manipulate the state of the reCAPTCHA, or using your reCAPTCHA solution on behalf of someone or something else, or anything else involving the site running *its* code in the context of & with the permissions of the reCAPTCHA site.

If none of that concerns you and you need to use this site, consider only accessing it in an isolated browser session where you do not visit any other site and where you run the browser in a disposable sandbox that gets dumped on quit. (And keep blocking the XSS requests.) You might also consider using Firefox Containers as an additional layer of protection.

[dreamy6477]

Disposable sandbox and firefox containers, I've not heard about that before. Thanks for the advice.