5
<script>
Something.execute("injectionpoint");  }, true);
</script>

I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is placed./ is filtered as \/.Any // present in payload is stripped out

Other characters such as ( ) , < , > , -- are not filtered

Here is an example with +alert(1)<!-- as payload

Something.execute("+alert(1)<!--"); }, true);

9

Bypass escaped double quote

Based on your description this should work:

\");alert("xss

The " will be escaped as \", thus resulting in \\", which escapes the \, but not the ".

To prevent this, you would at the very least have to also escape \ as \\.

Bypass escaped double quote and double backslash to single backslash

Based on your comment, I'm assuming the actual relevant parts of the filtering work like this:

  1. " -> \"
  2. \\ -> \

This isn't secure either. An injection might look like this:

\\\");alert(1

" will be escaped as \" in step 1 which leads us to \\\\", which is then transformed to \\" in step 2. You can't use double quotes in the injected string, but that's not a problem as XSS with single quotes or completely without quotes is perfectly possibly.

To secure this the double backslash would need to be escaped, not transformed to a single one, which would give us \\\\\\\\\" with the above described injection, which is safe.

  • 2
    +1. Was about to give the exact same answer. – Rahil Arora Apr 25 '15 at 16:37
  • @tim i tried it but it becomes Something.execute("\");alert(\"xss"); }, true); Any other way you can think of. – user2650277 Apr 26 '15 at 5:52
  • 1
    @user2650277 that behavior doesn't really match your description, and at this point we would have to guess as to what the filter actually is. It would be a lot easier if you could post the actual code. – tim Apr 26 '15 at 7:29
  • @tim have fun wordpress.org/search – user2650277 Apr 26 '15 at 13:36
0

Sounds like a modified PHP magic_quotes_gpc. "When magic_quotes are on, all ' (single-quote), " (double quote), \ (backslash) and NUL's are escaped with a backslash automatically."

This does not always work but here are a few bypasses:

  1. Use the method "String.fromCharCode()". For example alert('Ogglas'); would be: String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 79, 103, 103, 108, 97, 115, 39, 41, 59). You can use the plugin Firefox Hackbar to generate these strings. Note: I have not code reviewed the plugin so use at your own risk.

  2. Try to pass in URL-encoded HEX-values. You can also try a double encoded URL. Depending on the implementation, the first decoding process is performed by HTTP protocol and the resultant encoded URL will bypass the XSS filter, since it has no mechanisms to improve detection. Example:

    • Char -> ' -> Hex encoded value -> %27

    • Hex encoding % -> %25

    • Double encode -> %2527

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.