Prove XSS when most attacks result in a 403 error?

Question

While testing a website that has a responsible disclosure policy I found out that I can insert code and close the attribute and insert some text of my own:

<input type="text"  value=""xsstext>

Now sure I can send them an email showing them I can insert <!-- and comment out the rest of the page, but I do not think they will take that too serious. From what I tested it will throw a 403 error when using:

"javascript:
"onload=     (and onmouseover, onfocus etc.)
"onload:
"<script >
"<svg >
"<iframe>
"expression(

It is possible to insert for example:

<b>batman</b>
<img>
<div>

I'm quite new to XSS. Is there any way I can actually run some script or do something more useful here?

Answer 1

The filter here seems to be some kind of blacklist. It does not outright filter out or encode dangerous characters like < and >, but instead it completely blocks requests containing certain strings or patterns. It would not surprise me if the application itself has no XSS protection at all, but there is a web application firewall (WAF) in front of it that throws a 403 when it sees anything that looks dangerous.

The good news about this kind of filter is that they are seldom air tight. The bad news is that it can be hard to find something that actually makes it through. Here are some suggestions that may or may not work:

• Try case sensitivity: <sCRipT>, ONloAd
• Every single event handler in the book: onerror, etc., etc.
• Other dangerous URL schemes: <a href="vbscript:...">
• URL encoding ordinary letters: %3c%73%63%72%69%70%74%3e

For more inspiration, see the OWASP XSS Filter Evasion Cheet Sheat. In general, try small things (e.g. just the string onerror, not " onerror="alert('XSS');") and see what passes, then work your way up to a full payload. And remember, this is a game where persistence is rewarded.