2

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such that if i were to enter 

<body onload="alert('XSS')">

as the vector, only this would be displayed on the page:

body onload

(The < and > symbols are only removed, equal signs are also removed along with everything after them)

The little sideways carrot symbols and equal signs are the only part of the user input that is not sanatized. So there can be parenthesis, semicolons, colons, brackets, etc. Would it even be possible to form a working payload out of a vector that meets these requirements?

Improve this question
1
  • What does "everything after" mean? Everything up until the next >? Or the next space? Also, is the payload echoed directly into the HTML, or it it echoed into a JavaScript variable that is then put into the HTML?
    – Anders
    Commented Jan 30, 2016 at 10:16

1 Answer 1

Reset to default
5

So landing an XSS where there's some filtering can be done a number of ways. An important consideration is where user input is appearing in the resulting page. For example if the user input is landing in the middle of a JavaScript block then the filters you're seeing won't really slow you down at all, something like ');alert(1); might work just fine.

If you're landing in the middle of an HTML element or in a parameter value it might be a bit trickier. A first port of call there would likely be to try encoding your vector or adding additional instances of your characters to catch out naive filters that don't canonicalize the data properly before filtering it. Good sources of potential vectors for this kind of thing are HTML5 Security Cheatsheet and the OWASP XSS Filter Evasion Cheatsheet

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .