I'm wondering if there is a way to bypass this xss filter
XSS Context: In a script tag
What the filter does:
- lowercases the user input
- doesn't encode
< >
UNLESS</script
is present (it doesn't encode >), - if it is it'll encode the first closing angle bracket so a payload would look like this:
</script>
I'm not that experienced in XSS so I don't know if there is a way to bypass it. My thought right now is if there isn't I'm going to hopefully try to find something that is being stripped from the user input and hope the stripping is done after the encoding of </script
(since nothing about </sccript>
, ect, gets encoded)
Edit:
an example:
<script>
var user_input = ''
</script>
the only way I know how to break out of this is either to use ' (which I can't because it's escaped), or use </script>
to close the script tag (https://jsfiddle.net/1uch6nv2/)
Edit2: I made a quick example of the filter being used, so maybe you can get a better idea, the escaping of ' and \ may not be full proof my in my script, but it is in the website I'm looking at.
It's in python so it's a little either to understand
user_input = ""
while True:
user_input = input("User Input: ")
user_input = user_input.lower()
user_input = user_input.replace("'", "\\'")
user_input = user_input.replace("\\", "\\")
print("<script>\n\t var user_input = '" + user_input.replace("</script", "</script") + "'\n</script>")
Example output:
User Input: </script>
<script>
var user_input = '</script>'
</script>
</SCRIPT
or</sCrIpT
for example.