0

OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed:

perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out

It also says this above it:

Null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy or use %00 in the URL string or if you want to write your own injection tool you can either use vim (^V^@ will produce a null) or the following program to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hypen control char). But the null char %00is much more useful and helped me bypass certain real world filters with a variation on this example:

Does this mean that you can't inject it straight into an input? Or do you have to use Burp Suite or some other tool?

  • Are you still talking about the perl script in last sentence, or generally about null byte techniques? – Eda190 May 25 '17 at 0:18
  • @Eda190 Talking about: perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out – anonymous May 25 '17 at 1:51
  • Explained here stackoverflow.com/questions/4888415/… – Eda190 May 25 '17 at 15:35
  • @Eda190 Submit that as an answer! – anonymous May 26 '17 at 1:04
0

As stated on stackoverflow, the Perl script in this attack vendor serves as "launcher" of the attack, not as part of it. Important part in it is the null byte \0 part, which can theoretically fool the blacklist, as java\0script does not equal javascript. The %00 vendor you have specified is null byte too, however in URL encoded form. It will only work if you find website, that is has vulnerable part of the URL. Burp Proxy can however be used the same way like Perl script, but you're looking for the Hex value to change, rather than injecting \0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.