7

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the attack by encoding the script I put in URL. I am performing the attack as explained on official OWASP page. In order to bypass the XSS auditor of chrome I am following the trick explained in this amazing article (even though he explains Reflected XSS in article but it works well for DOM XSS also). So how can I perform DOM XSS attack on latest Firefox?

Note: I am able to perform Reflected XSS with Firefox (example) but I want DOM XSS specifically where the information is not sent to server.

11

The reason is simple: Firefox (I think from version 27 on-wards) now encodes (URL encoded) everything and you can now only exploit DOM XSS in Firefox if in the code developers will do explicit mistake of decoding.

You may find this recently published article useful: http://www.lanmaster53.com/2014/3/dom-based-xss-revisited/

  • Well I also concluded that same after a lot of tries. Thanks for the response :) – Siddharth Mar 9 '14 at 12:58
5

Maybe review https://code.google.com/p/domxsswiki/wiki/Index to help you determine which characters are encoded or not based on the browser vendor.

For example, in the following... scheme://user:pass@host/path/to/page.ext/Pathinfo;semicolon?search.location=value#hash=value&hash2=value2... the characters that are not url encoded in the PathInfo part, search part, and hash part in Firefox are listed below (screenshot of a part of the page linked above):

enter image description here

  • That helped @Tate . Vote Up for that :) But I am still searching how can I exploit the vulnerability in Firefox because '<' and '>' are getting URI encoded in FF (which we can see in above pic also). – Siddharth Mar 7 '14 at 7:45
  • @Tate, So... in other words it's not exploitable? – Pacerier Jan 26 '16 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.