During our Red/Blue team practice my friend made a web forum application where people can post messages.
What he did was filtering:
- The equal sign
- Some keywords that usually make html tags: "script" "img" "video" "iframe"
- The word: "cookie"
- The word: "eval"
The purpose of the game practice is for the red team to put a payload that steals users' cookies.
My friend made a mistake by making his own filter (not recommended in the real world). He forgot to filter the svg and the style tags.
Can be seen in my request bin endpoint.
However I cannot seem to steal cookies because I am not able to use
document.cookie because "cookie" is filtered. Plus the equal sign being filtered it becomes more difficult...
Some other red teams were able to bypass his filter, so there must be a payload that works...
What I tried so far:
- UTF encodings with
%3Dand others => fail
- Other html encoding
Any ideas will be much appreciated