Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a piece of code that allows for


BB-Code and replaces it with

<a href="someurl">someurl</a>

It takes two precautions to prevent XSS.

  1. It replaces '<','>' and '"' using a simple str_replace
  2. Uses a Regex to detect 'javascript:' and 'data:' protocl handlers

Since browsers decode the attribute value before further interpreting it, you can get around the regex check by encoding the URL using : [url]&#x6A ... [/url]

So I get:

<a href="javascript:alert(1)">javascript:alert(1)</a>

Long story made short: I want more than a steenkin attribute tage (who would click a link looking like that?!)

Can I somehow encode my '"' '<' etc. so it won't be replaced by the str_replace but still be interpreted in the context of HTML.

share|improve this question
I think this question belong to SO –  F. Hauri Jan 15 '13 at 14:54
I agree this should be on StackOverflow since you're asking how to code something in a particularl language. I flagged it as off-topic, hoping a moderator can migrate it. –  David Stratton Jan 15 '13 at 15:48
It is related to security, er4z0r asks how to bypass the described filter to run javascript code. –  Dinu S Jan 15 '13 at 15:54
@DinuSmădu - Asking how to encode it is a programming question not a security question. –  Ramhound Jan 16 '13 at 17:40
@Ramhound Maybe the question is not well formulated. I understood that the question is how to encode in order to bypass the filter. –  Dinu S Jan 16 '13 at 19:56
show 2 more comments

2 Answers

A blacklist approach will always be flawed. For example, under internet explorer you can use the vbscript: URI to execute vbscript code. There are also ways of encoding javascript: to bypass this check. There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser. This is just two examples, but really there could be any URI handler registered on a target system.

I would run this though a htmlencode routine to encode all quote marks and angle brackets. The benefit of this is that the URL could legitimately contain quote marks without being damaged. This is because the browser will automatically perform an html-decode of all attribute values as they are loaded. Then I would enforce that the first 4 characters are http. If the string does not start with http:// or https:// then prepend http://

share|improve this answer
Thanks Rock. I think you misread my question. I already do the HTML encoding to get around the blacklist (and of course I know that whitelisting is the way to got). What I cannot do using HTML-Encoding is breakt out of the context of the attribute value because if I encode the whole string with html encoding this will not work to add new attributes to the href tag or close the tag since HTML does not decode stuff like &#x6A into characters outside the context of the attribute value. –  er4z0r Jan 16 '13 at 10:37
I did not know about the vbscript: handler. Do you know about a good list of handlers that one could try? I did not find the information with OWASP –  er4z0r Jan 16 '13 at 10:44
It depends on what is installed on the host. Registered protocol handlers are located in the Windows registry under: HKEY_CLASSES_ROOT\PROTOCOLS\Handler. Handler examples: irc, geo, mailto, magnet, mms, news, nntp, sip, sms, smsto, ssh, tel, urn, webcal, xmpp. –  Cristian Dobre Jan 16 '13 at 11:04
@er4z0r use a whitelist approach, a blacklist will always fail. You cannot possibly know every bullshit URI, I could just come up with one right now on my own machine. –  Rook Jan 16 '13 at 15:34
@Rock: Again. This is not about DEFENSE. It is about OFFENSE. I know perfectly well that blacklisting sucks. I want to know if there is a way to gain more than just execution in the context of href –  er4z0r Jan 21 '13 at 23:45
show 1 more comment

You can trick someone into clicking on a link like this though:

Javascript: an_open_source_clientside_scripting_language_commonly_implemented_as_part_of_a_web_browser_in_order_to_create_enhanced_user_interfaces_and_dynamic_websites(); function an_open_source_clientside_scripting_language_commonly_implemented_as_part_of_a_web_browser_in_order_to_create_enhanced_user_interfaces_and_dynamic_websites() {alert(1)}

You could try UTF7 encoding evasion but is no longer supported in modern browsers.

share|improve this answer
Thanks for your tips. The idea to trick the user into clicking the link like this is ver creative. I like :) The utf-7 approach won't work for me since the target correctly sets the charset to utf-8 –  er4z0r Jan 16 '13 at 10:43
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.