1

On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing; ?type=<script<script>>alert(1)</script<script>> Which gave me a homepage which presented me with the headline-text: <script>alert(1)</script> So I am pretty close.

The Page Source had the following HTML: <h1>&lt;script>alert(1)&lt;/script></h1> So for some reason only the Less-than is transformed into &lt. As soon as I send in the &-sign the whole html-injection is filtered out.

Any suggestion on how I can bypass this. I have tried double encoding to get the real "<"-sign. Any "<"-sign sent into the URL gets converted into &lt.

I have tried suggestions from OWASPs checklist, Portswagger, Stackoverflow etc. The injection is out-of-tags. It is not in a script or html-tags, so I need to put it between tags according to me.

| improve this question | | | | |
2

I take it you have a situation like this:

<h1><!-- Data is inserted here. --></h1>

That is what OWASP calls inserting "into HTML element content" in their cheat sheet. To get anything done in thet context you will need to open a tag, so you will need a <. Without that, you are toast at that specific location.

The protection they are using seem to be some weird sort of homebrew that does multiple things at once without any real strategy. But it does look like it replaces all < with &lt;. You should try the usual stuff like mixing case, throwing in whitespace at unexpected places, or using different tags (e.g. an image with onload). But if you cant get a < in there, you are not going to get anywhere.

I wouldn't be very hopeful to get anywhere at that specific injection point. But since the defence looks a bit haphazard I would keep looking for other injection points. Perhaps inside a HTML attribute, or maybe in a comment or a script tag or something like that.

| improve this answer | | | | |
  • Just refer to servletsuite.com/servlets/xssflt.htm – Ajay Takur Mar 12 at 10:00
  • Is it possible to add (e.g 0025 + 0256) two symbols/bytes etc to get a "<"? – Oskar Mar 13 at 12:48
  • @Oskar If there is some sort of mismanagement of character encodings on the server side, you could potentially use that. But I don't think the odds are great. – Anders Mar 14 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.