1

I'm currently facing this possible reflected XSS vulnerability on a webapp:

URL = http://www.test.com/login/?login=[PAYLOAD]

When a user clicks on this link, it displays a login page that includes the following code:

<a href="http://www.test.com/login/[PAYLOAD]><img...></img></a>

I tried to close the <a> tag using > with different encodings, but this is filtered and displayed as %3E. I also tried to close the double quote and use some things like onclick etc. but this is filtered as well.

So I was wondering, is there any tool out there that can automatically test all characters in a given set with different encodings to see what is filtered ?

I could create my own script to do that, but it might save some time and well... reinventing the wheel..

Update:
So it appears that there is no tool that provide such capability. ie: test and report for every input what is filtered (and how it renders) or what is not. Burp ends up being the best solution to do that semi-manually, and a Burp extension can be done to fully automate this process.

1
  • Very nice and well presented a question. A well-deserved +1 from me.
    – Adi
    Oct 15, 2013 at 16:56

1 Answer 1

4

You could probably use Burp Suite to do this. Burp Proxy will let you intercept an HTTP request to a specific URL, http://www.test.com/login/?login=[PAYLOAD] for example.

Once you have intercepted this request you can specify which of the parameters you would like to target using Burp Intruder(in this case login).

Next you can specify a payload that you would like to apply to this parameter. You can choose from a number of existing payloads or you can create your own.

When you begin the attack it will fire a request with every item in your payload set and give you a number of options for examining the result, such as grepping for the payload to see if it made it through intact.

Hope this helps!

6
  • Reason for downvote? Oct 15, 2013 at 17:48
  • I was wondering as well ? I'll try with Burp Intruder tomorrow, i'm unsure the grep part can be automated as I'd like. I want to see if I can still escape the <a> tag for this particular case, but basically what I would like also is a list, for each input, of what's filtered / what's not.
    – ack__
    Oct 15, 2013 at 18:10
  • 2
    Right on, let me know how it turns out! The grep functionality may work for your needs. Basically you would grep the response to see if the un-encoded character is in there. So if you submit > in the payload you would grep for <a href="http://www.test.com/login/>. If it is encoded the response will contain <a href="http://www.test.com/login/%3E instead, so it will say there is no match. Let me know if that is confusing. Oct 15, 2013 at 19:57
  • So I did this with Burp Intruder for this particular test and it worked fine, but after looking everywhere it appears there's no software/plugin to do this automatically on every input you want. Thank you anyway I'll mark this as the right answer.
    – ack__
    Oct 19, 2013 at 9:10
  • Hrrm, you should be able to specify your own input file. I use the pay version so maybe that is a paid feature? Oct 19, 2013 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .