0

I am trying to execute an XSS payload on a search field that takes my input like this:

<input name="q" id="gsasearch" type="text" value="My Input"></input>

Observations:

  1. <, > and " are filtered. However, HTML encoding these characters work.
  2. The input is URL encoded and URL decoded and displayed to me.
  3. There are no parameters.

Payloads used is HTML encoded version of is qq"><script>alert('xss')</script>.

However, all i see in the result page is qq"><script>alert('xss')</script>.

XSS doesn't execute in both Chrome and IE. If I inspect the element, I see this:

<input name="q" id="gsasearch" type="text" value="qq"><script>alert('xss')</script>"></input>

After using F2 in dev tools, I could see that " is getting converted to &quot;, as shown below:

<input name="q" id="gsasearch" type="text" value="qq**&quot;**><script>alert('xss')</script>"></input>

So,

I/p--> URL encoded --> URL decoded --> HTML encoded if its a "

Is there any way to bypass this?

1

The developer console and the "inspect element" functionality of the browser is not a good way to check for XSS. This will show unencoded HTML elements, even though they are really properly encoded:

enter image description here

When pressing F2 or selecting "Edit as HTML", it properly shows the encoded characters:

enter image description here

  • There may additionally be a CSP in place which prevents inline scripts from executing. – Polynomial Dec 12 '18 at 10:18
  • Thanks. There is no CSP in place. i checked using F2 and they are encoding the " character. &quot;><script>alert('xss')</script>" > Is there anyway to bypass this ? – pratik pattanaik Dec 12 '18 at 10:19
  • You should make a new question if you want an answer to that @pratikpattanaik. Although, it may be quite a broad question, or possibly a duplicate. As bypassing things like this are a common topic in the security community while having a large opportunity for vectors. Not to mention the need to account for specific circumstances of different applications, filters, etc. – xorist Dec 13 '18 at 14:34
0

Is there any way to bypass this?

It depends on the application. There are multiple ways;

  1. Submitting different encoded version of "

You can try URL encoding i.e. %22, double URL encoding i.e. %2522, Unicode equivalents, etc.

  1. Submitting multiple "

Sometimes, only the first occurrence of special chars are escaped. So, if you submit two ", the first would be encoded while the second remains as is.

Aside from bypassing ", it's also possible to trigger XSS without bypassing ", if stars are aligned. Long story short- IE parses <meta> before doing any real parsing. Thus, using <meta> tag you can define a different charset for the page and trigger XSS using that charset. Here's a live example;
https://cm2.pw/research/ie/meta.php

And, instead of viewing "Inspect Elements", you should be viewing source code instead.

0

Both Chrome and IE implement a XSS filter measures that block the most basic XSS vulnerabilities.

If you are testing if a page is vulnerable, I would recommend either testing with Firefox or running Chrome with the --disable-xss-auditor parameter in order to disable it (be careful not to have any previous instance open, or it will reuse the previous session and ignore the parameter).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.