Waraxe IT Security Portal

aritmos · Advanced user

I send this XSS:

"><script>alert('xss')</script><f

Browser you can see:

"><script>alert('xss')<%2Fscript><f

And source code generated:

<input name="query" value=""><script>alert('xss')</script><f" class="text text_query query" id="query" type="text">

how can i evade the filters?

Cyko · Moderator

Problems:

1. Double quotes are converted to entities.
2. The < and > characters are also converted to entities.

Theirfore (too my knowledge) you can't brake out of the value attribute (in that format) - which is whats needed to execute/parse any JavaScript (as the value attribute can't execute/parse JavaScript on its own).

If the attribute was an on* (onclick, onhover etc.) attribute their would'nt be any problems (as their'd be no need to use double quotes or < and > characters) - infact it would be a breeze.

On a side note to the site owner - I assume the site is using htmlspecialchars(), I'd recommend to set the second paremeter to ENT_QUOTES to allow not only double quotes but single too (as currently its just converting double) - always a good idea to further migitate the risk of XSS attacks.

More info:

http://www.w3schools.com/tags/att_input_value.asp

http://ha.ckers.org/xss.html

aritmos · Advanced user

then...is it imposible to do a xss injection?