I've been learning about XSS recently, and then I was trying to come up with ways to bypass anti-XSS filters in browsers. I though, "Maybe if you used a link shortener that virtualized your site!", similar to how a proxy site virtualizes pages, or W3Schools' Try It Editor (except it doesn't show code). The concept is that a link shortener would use a suspicious link and render the page into a virtualizer.

For example, Bob finds an XSS vulnerability in a site and shorten it into a shortened link; any shortened link less suspicious than https://vulnerable.com/<scRIPt>alert("XSSed!");</scriPT>. Bob would use the virtualizing URL shortener and put the above URL as the link and it would be virtualized into an <iframe> or something and not warn the user of malicious code and then send it to someone, who would then click on it.

Would this work to bypass XSS filters? Does a site like this already exist?

  • How would a link shortener solve that? Could you be a little more specific on the approach you're suggesting? – Arminius Apr 27 '17 at 22:58
  • There, I edited it. – anonymous Apr 27 '17 at 23:08

Ordinary URL shorterners are commonly used to hide the payload and make links look less suspisious. However, they do not help against the browsers XSS filters, since what an ordinary URL shorterner does is simply issuing a redirect.

You suggest an approach to bulding an URL shorterner that does bypass the browsers XSS filters using what you call virtualization instead of redirects.

The way to do this virtualization would be using an iframe. The only problem is that the browsers XSS filter will (probably) be protecting the iframe in the same way that it is protecting you when you enter a URL in the URL bar. So you don't win anything.

And using an iframe is the only way I can think of doing "virtualization" without running into the SOP. So I don't think this is a viable concept.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.