0

When I scan website with burp suite pro, I encountered a XSS. This XSS is

   <a b=c>

When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters can't pass. For this reason burp suite report only <a b=c> parameter.

As you know this means <a b=c>

  • a can be replace img

  • b can be replace onerror

  • c can be replace alert

But this parameters(img ,onerror, alert) prevented on the server side. For fix this XSS problem, input validation can be solution.

According to burp, this is XSS. Is it really dangerous XSS? What problems might I encounter when I ignore this XSS ( <a b=c>)?

4

The problem is that there are a whole load of ways to get XSS in such a case:

<style src="http://ha.ckers.org/xss.css"/>
<a onclick=alert(1) style="position:absolute; display:block; z-index: 9999; top:0; left:0; width:10000px; height: 10000px"></a>
<div onmouseover='alert(1)'/>
<svg src=x onerror='eval("...")' />

Just to name a few off the top of my head.

The XSS Filter Evasion Cheat Sheet should give you some idea of how many ways there are to attack such vulnerabilities. Even if you blacklist a thousand different strings, you'll probably never get them all. Even if you somehow manage to blacklist all today's supported tags and events, across all browsers, your filters will be out of date in a month.

You need to move to a whitelist-based solution, or implement a proper semantic XSS filter library. OWASP has some good guidelines on preventing XSS which you should take a look at.

1

Web browsers evolve constantly. It is possible (although very rare according to my experience) that you manage to create a blacklist that blocks every meaningful XSS attack today, but tomorrow a new browser feature may introduce new possibilities for the attacker. You can check out http://html5sec.org/#html5 to see how many weird just got introduced recently.

So my answer is that this is most probably an exploitable XSS (or it will become one eventually), so you should implement more robust defenses like output encoding.

  • You right.Output encoding can be helpful in this situation. – fr3ddgn Mar 24 '15 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.