5
<script>
Something.execute("injectionpoint");  }, true);
</script>

I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is placed./ is filtered as \/.Any // present in payload is stripped out

Other characters such as ( ) , < , > , -- are not filtered

Here is an example with +alert(1)<!-- as payload

Something.execute("+alert(1)<!--"); }, true);

1

2 Answers 2

9

Bypass escaped double quote

Based on your description this should work:

\");alert("xss

The " will be escaped as \", thus resulting in \\", which escapes the \, but not the ".

To prevent this, you would at the very least have to also escape \ as \\.

Bypass escaped double quote and double backslash to single backslash

Based on your comment, I'm assuming the actual relevant parts of the filtering work like this:

  1. " -> \"
  2. \\ -> \

This isn't secure either. An injection might look like this:

\\\");alert(1

" will be escaped as \" in step 1 which leads us to \\\\", which is then transformed to \\" in step 2. You can't use double quotes in the injected string, but that's not a problem as XSS with single quotes or completely without quotes is perfectly possibly.

To secure this the double backslash would need to be escaped, not transformed to a single one, which would give us \\\\\\\\\" with the above described injection, which is safe.

4
  • 2
    +1. Was about to give the exact same answer. Commented Apr 25, 2015 at 16:37
  • @tim i tried it but it becomes Something.execute("\");alert(\"xss"); }, true); Any other way you can think of. Commented Apr 26, 2015 at 5:52
  • 1
    @user2650277 that behavior doesn't really match your description, and at this point we would have to guess as to what the filter actually is. It would be a lot easier if you could post the actual code.
    – tim
    Commented Apr 26, 2015 at 7:29
  • @tim have fun wordpress.org/search Commented Apr 26, 2015 at 13:36
1

Sounds like a modified PHP magic_quotes_gpc. "When magic_quotes are on, all ' (single-quote), " (double quote), \ (backslash) and NUL's are escaped with a backslash automatically."

This does not always work but here are a few bypasses:

  1. Use the method "String.fromCharCode()". For example alert('Ogglas'); would be: String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 79, 103, 103, 108, 97, 115, 39, 41, 59). You can use the plugin Firefox Hackbar to generate these strings. Note: I have not code reviewed the plugin so use at your own risk.

  2. Try to pass in URL-encoded HEX-values. You can also try a double encoded URL. Depending on the implementation, the first decoding process is performed by HTTP protocol and the resultant encoded URL will bypass the XSS filter, since it has no mechanisms to improve detection. Example:

    • Char -> ' -> Hex encoded value -> %27

    • Hex encoding % -> %25

    • Double encode -> %2527

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .