1

First of all i don't know if this question already mention here, believe me i search already.

so i was trying to break string inside single and double quote of attr below;

onclick="window.location='{$url4stat}en'"

now lets say the webapps urls like http://example.com/index/

i was able to inject random param after the /index/ path which is /index/?rand=123 and was included in respond boby such; onclick="window.location='/index/?rand=123&stat=en'"

so i though it might work somehow putting a double quote " and see if the html respond body breaks. turns out it gets encoded %22 onclick="window.location='/index/?rand=%22&stat=en so putting lazy "><script>alert(1)</script> payload will useless ( i've tried )

But, using burpsuite i was able to edit the encoded request before being send to webserver, when open the respond body in browser the alert just pop! is this means that it's prone to XSS ? if so, my question is it possible to bypass this? i already try double encode, using hex, %23x, and many other payload but nothing's work. turns out double encode payload will stay, if i put %2522 the respond body becomes onclick="window.location='/index/?rand=%2522&stat=en nothing change, same with other payload. it looks like only a few char such ", ', >, <, will be encoded. if i ran into IE Browser, the payloads work. only Chrome,FF, have not yet tried on Opera and Safari.

Will appreciate any suggestion,technique,payloads.

Improve this question

1 Answer 1

Reset to default
4

Sounds like it is vulnerable, and you have hit the anti-XSS filter in modern browsers.

For testing I suggest you disable the filter.

When reporting these issues to clients, I take the line that you can't be sure whether a user will have such a browser, and report anyway. That has been ok so far, although I can see in the future I will need to distinguish between XSS that is exploitable through the filter (high risk) and other XSS (should still be fixed, but lower risk).

Improve this answer
1
  • thanks pal, i never thought it first. it works on IE-8 as i follow the instructions how to disable xss protection on IE. sadly i tried disable xss-auditor in chrome and urlbar.filter in ff, the payload still encoded in respond body ~_~ anyway many thanks for your kind, helps me create poc scenario for clients.
    – xgun
    Mar 13, 2014 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .