I am trying to do a bypass on a page for an XSS but I can not, I would appreciate it. The scenario is as follows: The page displays the following:

http://www.webpage.com/jm/web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=Tracking code

When trying to put any xss, I appear for example: your research: ScriPtALeRti am here/scriPt had 0 results

I tried to evade it, because it shows that it recognizes the "<>" and so I put the following:


However, nothing is displayed. In the console of the page, I see the following:

web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=&lt;svg&gt;&lt;a&gt;&lt;rect%20width=100%%20height=100%&gt;:310 A Parser-blocking, cross site (i.e. different eTLD+1) script, http://www.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message.See https://www.chromestatus.com/feature/5718547946799104 for more details.*

If I click on where this is generated, I get the following, which shows that it uses 'unescape':

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

Thanks for your help.

  • If this is a challenge, try harder and use Google, there are plenty of XSS cheat sheets out there. If this is a live website, we can not help you. – Jeroen - IT Nerdbox Aug 22 '17 at 19:19
  • @Jeroen-ITNerdbox Okay, but I only ask you something, is that a vector of xss? – mojoj Aug 22 '17 at 20:41
  • It could be a vector of XSS or HTML injection, however, in your example it seems like it strips specific characters such as "<", ">", "(", ")" which leads me to believe that it is not exploitable, based on the information I've read. – Jeroen - IT Nerdbox Aug 23 '17 at 7:16

For me it's definitely looks like XSS. Seems like challenge here is to obfuscate your input. My suggestion will be to investigate flaws in unescape method.

Your third input suggest, your browser might contains some plugins which prevents you from executing injected scripts.

  • Some vector that you would put in this? I've really looked for more of the flaws in unescape now but I do not find much. I tried executing the attack vectors in other browsers (Mozilla-Chrome) and it does not work ... For me it also seems XSS, but I do not know how to prove it. – mojoj Aug 22 '17 at 23:27
  • sorry my bad, unescape does not have any features for prevention from XSS attack. My suggestion though will be first to look for flaws in whatever does escaping. ie will it escape a<b given that you have, or use unicode a&#x3e;b will that work. or given that you have unescape there, you could try to escape unicode characters and try ie &%23x3e%3B also bear in mind, <script> is not only way to execute script – user902383 Aug 23 '17 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.