Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently facing this possible reflected XSS vulnerability on a webapp:

URL = http://www.test.com/login/?login=[PAYLOAD]

When a user clicks on this link, it displays a login page that includes the following code:

<a href="http://www.test.com/login/[PAYLOAD]><img...></img></a>

I tried to close the <a> tag using > with different encodings, but this is filtered and displayed as %3E. I also tried to close the double quote and use some things like onclick etc. but this is filtered as well.

So I was wondering, is there any tool out there that can automatically test all characters in a given set with different encodings to see what is filtered ?

I could create my own script to do that, but it might save some time and well... reinventing the wheel..

Update:
So it appears that there is no tool that provide such capability. ie: test and report for every input what is filtered (and how it renders) or what is not. Burp ends up being the best solution to do that semi-manually, and a Burp extension can be done to fully automate this process.

share|improve this question
    
Very nice and well presented a question. A well-deserved +1 from me. –  Adnan Oct 15 '13 at 16:56
add comment

1 Answer

up vote 3 down vote accepted

You could probably use Burp Suite to do this. Burp Proxy will let you intercept an HTTP request to a specific URL, http://www.test.com/login/?login=[PAYLOAD] for example.

Once you have intercepted this request you can specify which of the parameters you would like to target using Burp Intruder(in this case login).

Next you can specify a payload that you would like to apply to this parameter. You can choose from a number of existing payloads or you can create your own.

When you begin the attack it will fire a request with every item in your payload set and give you a number of options for examining the result, such as grepping for the payload to see if it made it through intact.

Hope this helps!

share|improve this answer
    
Reason for downvote? –  Abe Miessler Oct 15 '13 at 17:48
    
I was wondering as well ? I'll try with Burp Intruder tomorrow, i'm unsure the grep part can be automated as I'd like. I want to see if I can still escape the <a> tag for this particular case, but basically what I would like also is a list, for each input, of what's filtered / what's not. –  ack__ Oct 15 '13 at 18:10
2  
Right on, let me know how it turns out! The grep functionality may work for your needs. Basically you would grep the response to see if the un-encoded character is in there. So if you submit > in the payload you would grep for <a href="http://www.test.com/login/>. If it is encoded the response will contain <a href="http://www.test.com/login/%3E instead, so it will say there is no match. Let me know if that is confusing. –  Abe Miessler Oct 15 '13 at 19:57
    
So I did this with Burp Intruder for this particular test and it worked fine, but after looking everywhere it appears there's no software/plugin to do this automatically on every input you want. Thank you anyway I'll mark this as the right answer. –  ack__ Oct 19 '13 at 9:10
    
Hrrm, you should be able to specify your own input file. I use the pay version so maybe that is a paid feature? –  Abe Miessler Oct 19 '13 at 17:37
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.