1
  • There is client side javascript controls in place which restricts malicious characters.
  • All form data is transmitted via POST requests. In burp, I can see that all parameters are encrypted into one parameter and sent over the network.
  • INISafe SFilter need to be installed at the client side (something which filters inputs, encrypts traffic, antikeylogger)

I need to test for XSS and other forms of vulnerabilities and so need to modify the parameters. Does anyone have any interesting ideas to work around this.?

6
  • Are you sure the data is encrypted instead of simply encoded? Front-end encryption is the most pointless thing so I doubt many people do it. – billc.cn Nov 29 '16 at 10:22
  • 1
    You can remove all the Javascript controls that are in place before you load the page in the browser. Further, from your description, the encryption/encoding is also being done client side and after the fact which means that it is not concerned with what you have entered, it is just encrypting/encoding it. I don't see why you can't test for XSS or any other input vulnerability. – void_in Nov 29 '16 at 10:34
  • @billc.cn Yeah, the data is encrypted. Not many people do it. First time I am also encountering this. :D – arju Nov 29 '16 at 11:48
  • @void_in Actually its not just javascript. There are client side applications like INISafe SFilter. So, we really can't even type in anything into the forms, as it is filtered by this client side application. Any suggestions, anyone.? – arju Nov 29 '16 at 12:00
  • What kind of encryption? – multithr3at3d Nov 30 '16 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.