I am performing testing on a site that takes input from the user and places it between <span>
and </span>
. However, <
and >
from the user are encoded as <
and >
. Is there any payload that could possibly execute XSS in the site that doesnot use <
and >
?
-
Have you tried URL Encoding? %3C and %3E– HashHazardJul 17, 2016 at 3:53
-
%3C and %3E remain as it is. They are not decoded by browser.– AbiralJul 17, 2016 at 3:57
-
What about through a proxy? (i.e. Burp)– HashHazardJul 17, 2016 at 4:09
-
Sorry I did not get you. Can you explain what do I need to do in Burp suite ?– AbiralJul 17, 2016 at 4:11
-
Use the Intercept module to intercept the request and inject your XSS payload via the proxy to bypass any client side controls. If you need more help, open a chat for this question and we can talk more.– HashHazardJul 17, 2016 at 4:14
1 Answer
Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using <
and >
), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a <script>
block, or similar). If your input isn't being reflected anywhere else, and <
and >
are always encoded, then you can't exploit the page via XSS.
However, there might be ways to trick the server into sending un-encoded <
and >
without it meaning to. One way that I've seen is to send Unicode characters that aren't <>
but that the server might map down to those ASCII characters before reflecting them into the output. Consider characters like ˂˃
, ‹›
, ≤≥
, <>
, all of which may get mapped to <>
by a server and then not get encoded as < >
. No guarantees, but it does happen.
-
fwiw, i've never heard of any server or client auto-converting unicode to
<
or>
...– dandavisJul 17, 2016 at 12:31 -
1@dandavis You bet there is! For instance, this could happen with punycode conversions.– ArminiusJul 17, 2016 at 17:35
-
@dandavis: I've pentested a lot of web apps. It's not common, but I've seen it happen before. It's another tool for the toolbox, not a guarantee, but it's always worth checking for. Jul 17, 2016 at 19:56
-
to clarify: sure, there may be bad code out there that outputs real angle brackets from other "stuff", but i've not encountered such in 10 years of webdev, and as such i believe it to be uncommon and obviously defective, but would be surprised if OP faces such an issue...– dandavisJul 17, 2016 at 23:45