1

I got a parameter in URL that displays in the HTML <title> tag. The > and < are properly escaped. Charset cant be changed. No variants (e.g. hex, url, double url, base64) of encoding < and > are working.

The title tag is somewhat of a special case, since it doesnt have any onEvent attributes. Is there any other way to perform an XSS attack without closing the tag with </title>?

|improve this question
3

I would not treat the <title> tag any differently than I would treat any other tag, lika a <div>. The context you are talking about (inbetween HTML tags) is what OWASP call "HTML Element Content" in their XSS prevention cheet sheet. They recommend the following substitution rules:

& --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27;
/ --> &#x2F;

However, I can not for the life of me figure out how you would be able to do any mischief without < or >, so I think (as opposed to know) that you are safe. Still, there is no harm in following the OWASP recommendations to the letter.

In other contexts other sanitation rules are required, so do not take this as just endocing < and > is always OK. It is not.

|improve this answer
  • I would've thought an attack would be even less effective if you did the encoding for them. To encode the < yourself and pass &lt; instead is surely 'safer'? I could be wrong. +1 anyway. – user81147 Oct 21 '16 at 12:40
  • y, ive read owasp ofc. And if they ask to prevent other symbols like quotes or ampersand there must be a way to use only them to attack. That's what im looking for. Btw, i've tryed URL encoding (single or double) and hex encoding - all useless – Jin Oct 21 '16 at 12:41
  • 1
    And if they ask to prevent other symbols like quotes or ampersand there must be a way to use only them to attack. What do you mean? Supposing you're the attacker, are you asking whether you can bypass the encoding of < and > by injecting script without other characters instead? – user81147 Oct 21 '16 at 12:44
  • @Jin Maybe, it seems impossible to me. But that does not mean it is... I am hoping for more answers! – Anders Oct 21 '16 at 15:23
1

If the question is "Why do we need to encode characters other than < and >", this is because corner cases possibly exist. A naive example would be when the input from a text box is used to generate, say, an href, or an image source on the fly.

Possiblities:

<img src="&{alert('XSS Vulnerable')};">

The special character “&” is sometimes interpreted as a new JavaScript code segment (entity).

" [event]='code'

In many cases it may be possible for an attacker to insert an exploit string, with the above syntax, into a HTML tag that should have been like:

<A HREF="exploit string">Go</A>

resulting in: 

<A HREF="" [event]='code'">Go</A>

<b onMouseOver="self.location.href='http://bad.com/'">text</b>

As the client cursor moves over the bolded text, an intrinsic event occurs and the JavaScript code is executed.

There are many more corner/obscure (in today's world) cases where encoding just < or > may not be enough. Look up http://www.technicalinfo.net/papers/CSS.html for a decent (if not slightly outdated) run through of similar cases.

|improve this answer
  • I agree with what you say here, but the question is about putting the untrusted data in the title, e.g. <title>[untrusted data]</title>. I don't think your examples would work there. – Anders Oct 21 '16 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.