I'm wondering if there is a way to bypass this xss filter

XSS Context: In a script tag

What the filter does:

  • lowercases the user input
  • doesn't encode < > UNLESS </script is present (it doesn't encode >),
  • if it is it'll encode the first closing angle bracket so a payload would look like this: &lt;/script>

I'm not that experienced in XSS so I don't know if there is a way to bypass it. My thought right now is if there isn't I'm going to hopefully try to find something that is being stripped from the user input and hope the stripping is done after the encoding of </script (since nothing about </sccript>, ect, gets encoded)


an example:

var user_input = ''

the only way I know how to break out of this is either to use ' (which I can't because it's escaped), or use </script> to close the script tag (https://jsfiddle.net/1uch6nv2/)

Edit2: I made a quick example of the filter being used, so maybe you can get a better idea, the escaping of ' and \ may not be full proof my in my script, but it is in the website I'm looking at.

It's in python so it's a little either to understand

user_input = ""

while True:
    user_input = input("User Input: ")
    user_input = user_input.lower()
    user_input = user_input.replace("'", "\\'")
    user_input = user_input.replace("\\", "\\")
    print("<script>\n\t var user_input = '" + user_input.replace("</script", "&lt;/script") + "'\n</script>")

Example output:

User Input: </script>
     var user_input = '&lt;/script>'
  • Did you try other tags like <span> <img> <iframe> <div> ? XSS is also possible with them. Maybe look at this list -> github.com/payloadbox/xss-payload-list – CDRohling Apr 10 '20 at 20:44
  • @CDRohling updated my OP with my clarification – Annie Apr 10 '20 at 21:07
  • Did you try to check if the filter is case insensitive? If it is not, then you would bypass it with </SCRIPT or </sCrIpT for example. – reed Apr 11 '20 at 13:27
  • @reed yes, the filter lowercases the user input – Annie Apr 15 '20 at 10:10

An excellent resource for bypassing these kinds of rudimentary filters can be found on OWASP's Filter Evasion Cheat Sheet.

This is a pretty terrible filter. Whilst I have no direct access to what you're looking at, if it is as described then there should be no difficulty in bypassing it at all. Assuming this is your website or one you're providing feedback on, you should always use an industry standard and well tested XSS sanitizer, kept frequently up to date.

Examples (not endorsements!) of ones you might want to look at:

If you don't want to use a library (not recommended!), you might try aggressively escaping or removing special characters. This is bad for user experience, though.

  • Hey thanks for answering, I already looked at the OWASP top 10, didn't have one for my specific case. I know it might not be difficult I just don't have the knowledge to achieve it. Could you share? – Annie Apr 10 '20 at 18:41
  • Sure @Annie - have you tried an IMG tag based approach? Example: <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> – Max O Apr 10 '20 at 18:49
  • I haven't, the place where the user input is being injected into is inside a script tag and the user input is inside a string, so i'd either prevent the escaping of '' or i'd need to close the script, which I can't because </script` is being encoded when </scrip is detected – Annie Apr 10 '20 at 18:51
  • I'm confused - how is the HTML being injected into a script tag? I don't think that your particular use case may be vulnerable (without knowing anything about it) Also, have you tried ?> – Max O Apr 10 '20 at 19:56
  • my input I send to the web server is being reflected into a javascript variable, I updated my OP with an edit to give more clarification – Annie Apr 10 '20 at 21:07

Given the code example above, it seems you remembered that you are supposed to escape the escape character, but that line will only replace the escape character with itself, and thus has no effect. To properly escape in that context, I would first of all reject characters that I don't want/need. If I have to allow dangerous characters, I would escape all the non-alphanumeric characters with \xnn or \unnnn equivalents. ' would become \x27 or \u0027. You will want to use the \unnnn encoding if you want to support unicode characters outside ASCII.

  • I'm not a web developer, I'm looking to exploit the code I have provided. I simply tried to mimic the filter that I am against – Annie Apr 11 '20 at 11:04
  • \'-alert(1);// – Erlend Apr 11 '20 at 15:35
  • @Erland that does bypass my filter, sadly this filter escapes \ (with \\\) I just foolishly overlooked it when creating my exampe filter – Annie Apr 13 '20 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.