Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site Scripting attack. I looked through the source code of the app and found the following Java code:

if (request.getMethod().equals("POST") && comments != null)
{
    anticsrf = request.getParameter("anticsrf");
        if (anticsrf != null && anticsrf.equals(request.getSession().getAttribute("anticsrf")))
            {
                // Strip script tags, because that will make everything alright...
                comments = comments.replace("<script>", "");
                comments = comments.replace("</script>", "");
                // And double quotes, just to make sure
                comments = comments.replace("\"", "");
            .................
            }
}

The challenge says:

"Display a popup using: <script>alert("XSS")</script>"

but looking at the source, we find that the <script> and </script> tags are replaced by null characters. Also I cannot make a GET request because the code also verifies whether the request is a POST request or not.

I have tried and succeeded in executing an alert box using other methods like using an external .js file and so, but I really want to find how one could complete this challenge. Please give me some suggestions on how to go about solving this one.

share|improve this question

migrated from stackoverflow.com May 8 '12 at 19:11

This question came from our site for professional and enthusiast programmers.

3  
You could just add some whitespace and use ' instead of ": <script >alert('XSS')</script > There are also plenty other methods. –  Gumbo May 7 '12 at 17:27
    
Another genius!! I love your answer too...I never thought about adding spaces and i got a pop too but for some weird reasons, the challenge is still showing up as not solved...But i don't care. I just like your answers..Yours and Ilmari Karonen's...Thank You guys...:) PS: I had looked through the cheat sheet already but the challenge was to solve it using –  zoozo May 8 '12 at 11:54

5 Answers 5

Besides Gumbo's nice and simple answer, another possibility would be to use the last replace() call to bypass the earlier ones, for example like this:

<scr"ipt>alert('XSS')</scr"ipt>

In fact, I suspect this might be the solution that the author of the challenge was expecting: there's not much point in stripping double quotes except to deliberately allow this particular attack, and the "just to make sure" comment even calls attention to it.

Of course, even if the code didn't strip double quotes, you could still do this:

<scr</script>ipt>alert('XSS')</scr</script>ipt>
share|improve this answer
    
That’s not JavaScript but Java. –  Gumbo May 7 '12 at 18:14
    
Oh, that changes things. Let me replace my answer with another solution, then. –  Ilmari Karonen May 7 '12 at 22:27
    
@IlmariKaronen you are a genius. I never thought of this solution. That did not help solve the problem but I very much like your solution. Thank You :) –  zoozo May 8 '12 at 11:48

Upon reviewing your question again, I finally see what the challenge is trying to get you to achieve. Notice how the anti-XSS code is enveloped by an if statement that checks for the presence of an anticsrf parameter and whether it is equal to the anticsrf object present in the user's session object. By breaking any of these two conditions, you can effectively make the code above (<script>alert("XSS")</script>) work. In other words, if you exclude the anticsrf parameter from the request or change the anticsrf parameter in the request to something arbitrary, the comment parameter will be reflected verbatim because the code block stripping the XSS code will be skipped.

Other Stuff To Consider:

The <script> tag container is not the only place you can XSS. Take a look at the other HTML tags and what they can do. For instance, the following works with <img> tags:

<img src=javascript:alert('hi'); />

There are also the onload, onmouseover, etc. event handlers associated with a whole bunch of tags in HTML that could be leveraged for this purpose. My best suggestion would be to take a look at the HTML specification to get some more ideas. If you're going to become a web pen tester then you'll certainly want to arm yourself with that knowledge.

share|improve this answer
2  
Are there any browsers left that will respect a javascript: scheme URI for an image source? (Obviously you shouldn't let such code through as people do use old browsers, but it might not be useful for a demonstration of XSS). –  Quentin May 7 '12 at 17:34
1  
@Quentin: I just tested this, and Firefox 12, at least, will execute javascript: URIs in img src attributes, but won't permit them to call alert() (or, presumably, do anything else that would violate same-origin restrictions). I even found an old bug report about a hole in this mechanism, which may provide some insight into how and why it works like that. –  Ilmari Karonen May 8 '12 at 13:06

Auto-submitting form:

<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="...">
        ...
        </form>
    </body>
</html>

XSS without script tag:

<img src="missing" onerror="..." />
share|improve this answer

I like some of the other inventive postings here for answers.

Here's some simple & stupids that popped into my head right away:

<script >alert('XSS')</script >
<SCRIPT>alert('XSS')</SCRIPT>
share|improve this answer

You could insert other types of space & tabulators among the tags to bypass the filter.

For example:

<scr&#x9ipt>alert('XSS')</scr&#x9ipt>

The code above will put a tab between r & i in both tags, thus making the code ineffective.

To surpass the PHP script, you could try using grave accents (`) which are used in HTML but not filtered by most handwritten filters.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.