Any way to bypass this xss filter?

Question

I'm wondering if there is a way to bypass this xss filter

XSS Context: In a script tag

What the filter does:

• lowercases the user input
• doesn't encode < > UNLESS </script is present (it doesn't encode >),
• if it is it'll encode the first closing angle bracket so a payload would look like this: </script>

I'm not that experienced in XSS so I don't know if there is a way to bypass it. My thought right now is if there isn't I'm going to hopefully try to find something that is being stripped from the user input and hope the stripping is done after the encoding of </script (since nothing about </sccript>, ect, gets encoded)

Edit:

an example:

<script>
var user_input = ''
</script>

the only way I know how to break out of this is either to use ' (which I can't because it's escaped), or use </script> to close the script tag (https://jsfiddle.net/1uch6nv2/)

Edit2: I made a quick example of the filter being used, so maybe you can get a better idea, the escaping of ' and \ may not be full proof my in my script, but it is in the website I'm looking at.

It's in python so it's a little either to understand

user_input = ""

while True:
    user_input = input("User Input: ")
    user_input = user_input.lower()
    user_input = user_input.replace("'", "\\'")
    user_input = user_input.replace("\\", "\\")
    print("<script>\n\t var user_input = '" + user_input.replace("</script", "&lt;/script") + "'\n</script>")

Example output:

User Input: </script>
<script>
     var user_input = '&lt;/script>'
</script>

Answer 1

An excellent resource for bypassing these kinds of rudimentary filters can be found on OWASP's Filter Evasion Cheat Sheet.

This is a pretty terrible filter. Whilst I have no direct access to what you're looking at, if it is as described then there should be no difficulty in bypassing it at all. Assuming this is your website or one you're providing feedback on, you should always use an industry standard and well tested XSS sanitizer, kept frequently up to date.

Examples (not endorsements!) of ones you might want to look at:

• XSS.js - Node.js HTML santitizer

• HTML Purifier - PHP HTML sanitizer

• Sanitize - Ruby HTML sanitizer

If you don't want to use a library (not recommended!), you might try aggressively escaping or removing special characters. This is bad for user experience, though.

Answer 2

Given the code example above, it seems you remembered that you are supposed to escape the escape character, but that line will only replace the escape character with itself, and thus has no effect. To properly escape in that context, I would first of all reject characters that I don't want/need. If I have to allow dangerous characters, I would escape all the non-alphanumeric characters with \xnn or \unnnn equivalents. ' would become \x27 or \u0027. You will want to use the \unnnn encoding if you want to support unicode characters outside ASCII.