How to use Unicode encoding for evading XSS filter?

Question

Recently, I have come across a reported XSS where the attacker is Unicode encoding the payload in HTTP GET parameters to evade existing XSS filter -

My question is - when does the Server/application convert the Unicode to plain text? Is it upon reading the values of GET parameters? If yes, then why not the filter is able to detect it?

The attack is not working, when the same payload is provided in plaintext. App is deployed on IIS 7.

Any mitigation strategy for this type of evasion technique will also be appriciated.

UPDATE: https://www.ietf.org/rfc/rfc1738.txt restricts the use of unicode chars as URLs. what are the chances that IIS 7 still accepts unicode chars as part of URL GET values. I have some vulnerable php webapps for testing (DVWA, deployed in WAMP server) which are easily vulnerable to very simple XSS attack vectors like <script>alert(1)</script>. I tried replacing few characters with their Unicode equivalent but that encoded string doesn’t invoke XSS!!!

Answer 1

Use the package AntiXssEncoder of Nuget with:

Install-Package AntiXSS -Version 4.3.0

This Class has diferents encoders for each case in that this values is reflected, for example css, JavaScript, HTML, and URL; Use this methods depend on your case, for example:

In CSS use: CssEncode("data")
In Javascript use: JavaScriptStringEncode("data")

This solucion allow validate of major types for bypass the encoding, assurance to \u0027, %27 and much diferents options.

Other way is first normalize and encode the data, this allow validate for example, %u0027, \x00,%00 and change the value to specific language for evading bypass a validation.

https://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder(v=vs.110).aspx https://msdn.microsoft.com/es-es/library/ebza6ck1(v=vs.110).aspx

I hope that I help you.