2

I am trying to do a bypass on a page for an XSS but I can not, I would appreciate it. The scenario is as follows: The page displays the following:

http://www.webpage.com/jm/web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=Tracking code

When trying to put any xss, I appear for example: your research: ScriPtALeRti am here/scriPt had 0 results

I tried to evade it, because it shows that it recognizes the "<>" and so I put the following:

http://www.webpage.com/jm/web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=&lt;svg&gt;&lt;a&gt;&lt;rect%20width=100%%20height=100%&gt;

However, nothing is displayed. In the console of the page, I see the following:

web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=&lt;svg&gt;&lt;a&gt;&lt;rect%20width=100%%20height=100%&gt;:310 A Parser-blocking, cross site (i.e. different eTLD+1) script, http://www.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message.See https://www.chromestatus.com/feature/5718547946799104 for more details.*

If I click on where this is generated, I get the following, which shows that it uses 'unescape':

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

Thanks for your help.

3
  • If this is a challenge, try harder and use Google, there are plenty of XSS cheat sheets out there. If this is a live website, we can not help you.
    – Jeroen
    Aug 22, 2017 at 19:19
  • @Jeroen-ITNerdbox Okay, but I only ask you something, is that a vector of xss?
    – mojoj
    Aug 22, 2017 at 20:41
  • It could be a vector of XSS or HTML injection, however, in your example it seems like it strips specific characters such as "<", ">", "(", ")" which leads me to believe that it is not exploitable, based on the information I've read.
    – Jeroen
    Aug 23, 2017 at 7:16

1 Answer 1

1

For me it's definitely looks like XSS. Seems like challenge here is to obfuscate your input. My suggestion will be to investigate flaws in unescape method.

Your third input suggest, your browser might contains some plugins which prevents you from executing injected scripts.

2
  • Some vector that you would put in this? I've really looked for more of the flaws in unescape now but I do not find much. I tried executing the attack vectors in other browsers (Mozilla-Chrome) and it does not work ... For me it also seems XSS, but I do not know how to prove it.
    – mojoj
    Aug 22, 2017 at 23:27
  • sorry my bad, unescape does not have any features for prevention from XSS attack. My suggestion though will be first to look for flaws in whatever does escaping. ie will it escape a<b given that you have, or use unicode a&#x3e;b will that work. or given that you have unescape there, you could try to escape unicode characters and try ie &%23x3e%3B also bear in mind, <script> is not only way to execute script
    – user902383
    Aug 23, 2017 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .