7

I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site Scripting attack. I looked through the source code of the app and found the following Java code:

if (request.getMethod().equals("POST") && comments != null)
{
    anticsrf = request.getParameter("anticsrf");
        if (anticsrf != null && anticsrf.equals(request.getSession().getAttribute("anticsrf")))
            {
                // Strip script tags, because that will make everything alright...
                comments = comments.replace("<script>", "");
                comments = comments.replace("</script>", "");
                // And double quotes, just to make sure
                comments = comments.replace("\"", "");
            .................
            }
}

The challenge says:

"Display a popup using: <script>alert("XSS")</script>"

but looking at the source, we find that the <script> and </script> tags are replaced by null characters. Also I cannot make a GET request because the code also verifies whether the request is a POST request or not.

I have tried and succeeded in executing an alert box using other methods like using an external .js file and so, but I really want to find how one could complete this challenge. Please give me some suggestions on how to go about solving this one.

Improve this question
2
  • 3
    You could just add some whitespace and use ' instead of ": <script >alert('XSS')</script > There are also plenty other methods.
    – Gumbo
    Commented May 7, 2012 at 17:27
  • Another genius!! I love your answer too...I never thought about adding spaces and i got a pop too but for some weird reasons, the challenge is still showing up as not solved...But i don't care. I just like your answers..Yours and Ilmari Karonen's...Thank You guys...:) PS: I had looked through the cheat sheet already but the challenge was to solve it using
    – zoozo
    Commented May 8, 2012 at 11:54

5 Answers 5

Reset to default
12

Besides Gumbo's nice and simple answer, another possibility would be to use the last replace() call to bypass the earlier ones, for example like this:

<scr"ipt>alert('XSS')</scr"ipt>

In fact, I suspect this might be the solution that the author of the challenge was expecting: there's not much point in stripping double quotes except to deliberately allow this particular attack, and the "just to make sure" comment even calls attention to it.

Of course, even if the code didn't strip double quotes, you could still do this:

<scr</script>ipt>alert('XSS')</scr</script>ipt>
Improve this answer
4
  • That’s not JavaScript but Java.
    – Gumbo
    Commented May 7, 2012 at 18:14
  • Oh, that changes things. Let me replace my answer with another solution, then.
    – Ilmari Karonen
    Commented May 7, 2012 at 22:27
  • @IlmariKaronen you are a genius. I never thought of this solution. That did not help solve the problem but I very much like your solution. Thank You :)
    – zoozo
    Commented May 8, 2012 at 11:48
  • @IlmariKaronen Fantastic. Your second solution worked perfectly for my purposes. Simple but very effective.
    – Ryan Dantzler
    Commented Feb 17, 2017 at 0:41
3

Upon reviewing your question again, I finally see what the challenge is trying to get you to achieve. Notice how the anti-XSS code is enveloped by an if statement that checks for the presence of an anticsrf parameter and whether it is equal to the anticsrf object present in the user's session object. By breaking any of these two conditions, you can effectively make the code above (<script>alert("XSS")</script>) work. In other words, if you exclude the anticsrf parameter from the request or change the anticsrf parameter in the request to something arbitrary, the comment parameter will be reflected verbatim because the code block stripping the XSS code will be skipped.

Other Stuff To Consider:

The <script> tag container is not the only place you can XSS. Take a look at the other HTML tags and what they can do. For instance, the following works with <img> tags:

<img src=javascript:alert('hi'); />

There are also the onload, onmouseover, etc. event handlers associated with a whole bunch of tags in HTML that could be leveraged for this purpose. My best suggestion would be to take a look at the HTML specification to get some more ideas. If you're going to become a web pen tester then you'll certainly want to arm yourself with that knowledge.

Improve this answer
3
  • 2
    Are there any browsers left that will respect a javascript: scheme URI for an image source? (Obviously you shouldn't let such code through as people do use old browsers, but it might not be useful for a demonstration of XSS).
    – Quentin
    Commented May 7, 2012 at 17:34
  • 1
    @Quentin: I just tested this, and Firefox 12, at least, will execute javascript: URIs in img src attributes, but won't permit them to call alert() (or, presumably, do anything else that would violate same-origin restrictions). I even found an old bug report about a hole in this mechanism, which may provide some insight into how and why it works like that.
    – Ilmari Karonen
    Commented May 8, 2012 at 13:06
  • @Quentin: there are plenty of other ways to get around that like <img src=somethingWrong onerror=alert('hi')>. HTML is really flexible and the possibilities for getting around naive anti-XSS implementations are endless.
    – Nadeem Douba
    Commented May 22, 2015 at 2:58
1

Auto-submitting form:

<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="...">
        ...
        </form>
    </body>
</html>

XSS without script tag:

<img src="missing" onerror="..." />
Improve this answer
1

I like some of the other inventive postings here for answers.

Here's some simple & stupids that popped into my head right away:

<script >alert('XSS')</script >
<SCRIPT>alert('XSS')</SCRIPT>
Improve this answer
-1

You could insert other types of space & tabulators among the tags to bypass the filter.

For example:

<scr&#x9ipt>alert('XSS')</scr&#x9ipt>

The code above will put a tab between r & i in both tags, thus making the code ineffective.

To surpass the PHP script, you could try using grave accents (`) which are used in HTML but not filtered by most handwritten filters.

Improve this answer

You must log in to answer this question.