2

I was trying to get XSS but and site validate input but when I entered https://google.com the site did this:

<a href="//google.com">https://www.google.com</a>

so I tried to do this:

javascript:alert(7)

the site did this:

<a href="//javascript">:alert(7)</a>

Does anyone have an idea how to bypass this filter?

1
  • it's a very clear question and I'm testing the site not trying to damage it
    – Malek
    Jul 20 '18 at 8:23
1

If you want to get anywhere in security and finding bugs, bypassing security measures you need to start to get more creative and more experimentative (if that's even an english word).

In this case:

  1. Choose an input.
  2. Feed it through the black box.
  3. Get the output
  4. Make a theory: How does the black box transform my input -> output
  5. Choose a different input and repeat until confident that you're theory is correct.
  6. Adapt/update/change theory with new information from (input, output) pairs.

A possible theory in this case would be that the black box simply replaces https with an empty string. How do we verify this: Well... we enter "hihttpsthere" and see if we get "hithere" as output. But it transform javascript:alert(7) to (//javascript,:alert(7)) so maybe it's splitting at :? Maybe it tries to parse the protocol of the URL? Use some urlencoded stuff, use non-printable characters, maybe even use a fuzzer? It could even be that their filter makes an XSS impossible.. could be. You'll have to find out.

It's all about trial and error.

I was trying to get xss but site valdiate input

That's what it's supposed to do anyway. You can't expect that you can do an XSS everywhere.

1
  • Thanks for all information it's very useful, i tried to understand what site do and i found out that when i enter javascript:alert(7) it won't be in <a> tag but when site found http://anything or https://anything site will display it in <a> tag so i did this https://javascript:alert(5) it becomes <a href="https//javascript:alert(5)" and when i tried to do this http://javascript:alert(6) it becomes //javascript:alert(6) the problem here with // do you have any idea how can i bypass it !? , and Thanks again for your replay
    – Malek
    Jul 16 '18 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.