Bypass XSS

MANISHA

unread,

Aug 3, 2013, 5:57:26 AM8/3/13

to null-...@googlegroups.com

Hi All,

I am working on an application and trying to inject xss script. While trying to inject <body onload=alert('test1')> the view source saves as <BODY ONLOAD=alert('XSS')> . The tags , " , / are getting encoded.

Can aynone let me know how to bypass this filter and execute xss script.Please let me know any payloads or xss scripts.

Thanks,

Manisha

MANISHA

unread,

Aug 3, 2013, 6:29:11 AM8/3/13

to null-...@googlegroups.com

Can you please specify or give me the specific script and it also encodes double quotes like:

please find the below view source

Loyalty Programme Name:</label><input id="searchLPForm:j_idt81:j_idt94:lpName" type="text" name="searchLPForm:j_idt81:j_idt94:lpName" value="""><script>alert(1)</script>"" class

sechacking

unread,

Aug 3, 2013, 6:32:36 AM8/3/13

to null-co-in

like this

Loyalty Programme Name:</label><input id="searchLPForm:j_idt81:j_idt94:lpName" type="text" name="searchLPForm:j_idt81:j_idt94:lpName" value="" onerror=javascript:alert('robert')

thks&Best Regards

--
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
---
You received this message because you are subscribed to the Google Groups "null" group.
To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Vijay Velu

unread,

Aug 5, 2013, 4:21:07 AM8/5/13

to null-...@googlegroups.com

If it saves as &lt, &gt is a good practise that is being followed, sometimes developers forget to filter the below.

Try this a payload, <div onmouseover="javascript:alert(document.cookie);">Mouse over me</div>

Cheers

VkV

From: MANISHA <manishab...@gmail.com>
To: null-...@googlegroups.com
Sent: Saturday, 3 August 2013 3:27 PM
Subject: [null] Bypass XSS

XylUS

unread,

Aug 5, 2013, 3:09:03 PM8/5/13

to null-...@googlegroups.com

Hi Manisha,

Sanitizing the special characters is the best solution to mitigate the xss as of now.

I mean " -> &quot and <> &lt and &gt.

Its highly impossible to execute a script with out those special characters, its better to check where and all the places those characters are not getting sanitized.

And also don't forget to check the output for various encoded formats of inputs.(say URL encoding, double URL encoding etc).

Thanks,

XylUS

MANISHA BAJPAI

unread,

Aug 6, 2013, 12:57:02 AM8/6/13

to null-...@googlegroups.com

yeah thanks all.. I will try out the suggestions.

sechacking

unread,

Aug 3, 2013, 6:20:22 AM8/3/13

to null-co-in

you see this xss filter just encode < and > ,so you can inject the code to the html value or DOM.

thks&Best Regards

Reply all

Reply to author

Forward