I'm just testing a basic XSS injection attack. Given the images below, does it look like this website is vulnerable to XSS?
Is whitelisting the characters still the best practice against XSS attacks?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
From your screen shots, this page does not seem to be vulnerable to XSS.
The correct way to prevent XSS is by using output encoding. If a user types
<script> and the page puts
<script> in the HTML source, it is vulnerable to XSS. If it instead encodes that user input and puts
<script> in the HTML source, it is not interpreted as HTML but as the text
It looks like your site does this encoding twice instead of once, and this results in displaying the encoded HTML in the text fields.
The example within the question seems to show that they're preventing the tags from being used by targeting them. E.g.
<script>. However, if UTF encodes it and then SQL encodes it into something else, it's not technically secure. Therefore, using a different type of injection method can be used, which is an SQL injection and can be exploited by hex values, as shown below:
First you choose something to be encoded:
This will then be encoded to form this:
Then you can carry out the attack:
Here is an example of this from OWASP, when testing for a possible injection:
Select user from users where name = unhex('726F6F74')
Here 'root' is shown as the hex value 726F6F74
SQL Injection: https://www.w3schools.com/sql/sql_injection.asp
Another example can be found here: https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/#HexbasedSamples