3

I'm wondering if there is a way to bypass this xss filter

XSS Context: In a script tag

What the filter does:

  • lowercases the user input
  • doesn't encode < > UNLESS </script is present (it doesn't encode >),
  • if it is it'll encode the first closing angle bracket so a payload would look like this: &lt;/script>

I'm not that experienced in XSS so I don't know if there is a way to bypass it. My thought right now is if there isn't I'm going to hopefully try to find something that is being stripped from the user input and hope the stripping is done after the encoding of </script (since nothing about </sccript>, ect, gets encoded)

Edit:

an example:

<script>
var user_input = ''
</script>

the only way I know how to break out of this is either to use ' (which I can't because it's escaped), or use </script> to close the script tag (https://jsfiddle.net/1uch6nv2/)

Edit2: I made a quick example of the filter being used, so maybe you can get a better idea, the escaping of ' and \ may not be full proof my in my script, but it is in the website I'm looking at.

It's in python so it's a little either to understand

user_input = ""

while True:
    user_input = input("User Input: ")
    user_input = user_input.lower()
    user_input = user_input.replace("'", "\\'")
    user_input = user_input.replace("\\", "\\")
    print("<script>\n\t var user_input = '" + user_input.replace("</script", "&lt;/script") + "'\n</script>")

Example output:

User Input: </script>
<script>
     var user_input = '&lt;/script>'
</script>
4
  • Did you try other tags like <span> <img> <iframe> <div> ? XSS is also possible with them. Maybe look at this list -> github.com/payloadbox/xss-payload-list
    – Cyberduck
    Commented Apr 10, 2020 at 20:44
  • @CDRohling updated my OP with my clarification
    – Annie
    Commented Apr 10, 2020 at 21:07
  • Did you try to check if the filter is case insensitive? If it is not, then you would bypass it with </SCRIPT or </sCrIpT for example.
    – reed
    Commented Apr 11, 2020 at 13:27
  • @reed yes, the filter lowercases the user input
    – Annie
    Commented Apr 15, 2020 at 10:10

2 Answers 2

1

An excellent resource for bypassing these kinds of rudimentary filters can be found on OWASP's Filter Evasion Cheat Sheet.

This is a pretty terrible filter. Whilst I have no direct access to what you're looking at, if it is as described then there should be no difficulty in bypassing it at all. Assuming this is your website or one you're providing feedback on, you should always use an industry standard and well tested XSS sanitizer, kept frequently up to date.

Examples (not endorsements!) of ones you might want to look at:

If you don't want to use a library (not recommended!), you might try aggressively escaping or removing special characters. This is bad for user experience, though.

5
  • Hey thanks for answering, I already looked at the OWASP top 10, didn't have one for my specific case. I know it might not be difficult I just don't have the knowledge to achieve it. Could you share?
    – Annie
    Commented Apr 10, 2020 at 18:41
  • Sure @Annie - have you tried an IMG tag based approach? Example: <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
    – Max O
    Commented Apr 10, 2020 at 18:49
  • I haven't, the place where the user input is being injected into is inside a script tag and the user input is inside a string, so i'd either prevent the escaping of '' or i'd need to close the script, which I can't because </script` is being encoded when </scrip is detected
    – Annie
    Commented Apr 10, 2020 at 18:51
  • I'm confused - how is the HTML being injected into a script tag? I don't think that your particular use case may be vulnerable (without knowing anything about it) Also, have you tried ?>
    – Max O
    Commented Apr 10, 2020 at 19:56
  • my input I send to the web server is being reflected into a javascript variable, I updated my OP with an edit to give more clarification
    – Annie
    Commented Apr 10, 2020 at 21:07
0

Given the code example above, it seems you remembered that you are supposed to escape the escape character, but that line will only replace the escape character with itself, and thus has no effect. To properly escape in that context, I would first of all reject characters that I don't want/need. If I have to allow dangerous characters, I would escape all the non-alphanumeric characters with \xnn or \unnnn equivalents. ' would become \x27 or \u0027. You will want to use the \unnnn encoding if you want to support unicode characters outside ASCII.

3
  • I'm not a web developer, I'm looking to exploit the code I have provided. I simply tried to mimic the filter that I am against
    – Annie
    Commented Apr 11, 2020 at 11:04
  • \'-alert(1);//
    – Erlend
    Commented Apr 11, 2020 at 15:35
  • @Erland that does bypass my filter, sadly this filter escapes \ (with \\\) I just foolishly overlooked it when creating my exampe filter
    – Annie
    Commented Apr 13, 2020 at 18:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .