4

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :

  • It escapes <, >, " to their HTML entities, but not &, ) or (.
  • You are not in a tag, so you have to create your own.

It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?

| improve this question | |
  • 2
    Where exactly is it reflected? I.e. is it inside an attribute or text node or script tags, or style, etc..? – valentinas Dec 11 '13 at 1:08
  • 1
    I believe this is well documented. – rook Dec 11 '13 at 1:08
  • In addition to other answers, also see this about "mXSS attacks": reddit.com/r/netsec/comments/1skr62/… – domen Dec 11 '13 at 13:38
10

No, that's not necessarily sufficient. There are many XSS vectors that can potentially still be applied, depending upon where the injection point is.

Some examples:

  • Injection into unquoted attribute values

  • Injection into attribute values quoted with a single quote (' instead of ")

  • Injection into CSS

  • Injection into Javascript

  • Injection into comments

... and lots more. You need to do context-sensitive escaping, and you definitely need to escape at minimum <, >, ", ', plus some more in some contexts. Go spend some time on the OWASP site; there's tons written there, and this is explained in great detail.

| improve this answer | |
  • +1 (While you are right, I do not see where an escaped > would allow getting out of an HTML comment.) – freddyb Dec 11 '13 at 15:36
  • @freddyb, yeah, it's tricky. For comments, the key character is -, which has an interesting effect inside HTML comments (most people don't know about the surprising behavior of HTML/SGML comments). Such attacks are not easy and probably only possible in rare circumstances, but it's better to not inject dynamic values inside comments. – D.W. Dec 11 '13 at 19:53
  • I fully agree. Do you have any weird findings with regard to comments though? – freddyb Dec 15 '13 at 12:13
2

sometimes they escape "alert " parameter too, then you can use something like "onMouseOver" etc and you can find the full link here. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet (try xss locators)

moreover you can use %3C insead of < and so on... try url encoding etc.

and if the text is encoded in the background, you xss may not work...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.