Hi guys, is there any any method which let you to bypass double quotes encoding to \" in order to close the value tags? I don't need the String.fromCharCode() function, and there isn't any variable which saves the searched value...
The code looks like:

<input type="text" name="search" value="&quot;><script>alert(1)</script>">

Any help please?

Try it with and without url-encoding the ". (eg try in firefox and IE). If neither of those work, I don't think it is exploitable; see http://shazzer.co.uk/database/All/Characters-that-close-a-quote?

-------------------------------------------------------
Research blog

Have you tried injecting into the name side of the pair? I find that often the name side is left unfiltered by forgetful programmers.

You may also want to try double URLencoding.

You might want to try repeated quotes or higher repeated characters that end with the same hex value. Also depending on the browser different charsets too if not served with a UTF-8 charset.

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Gareth Heyes Wrote:
-------------------------------------------------------
> You might want to try repeated quotes or higher
> repeated characters that end with the same hex
> value. Also depending on the browser different
> charsets too if not served with a UTF-8 charset.

Can I have an example? I'm not sure i understand it at all



Edited 1 time(s). Last edit at 03/13/2012 08:33PM by Pr3nK.

Just repeated quotes like """""""><script>alert(1)</script> in case the regex is not in global mode. Then for charset based attacks try using cp based charsets in older versions of IE, utf-7 etc:

[hackvertor.co.uk]

Experiment I think Opera still allows charset inheritance from a parent iframe so that might be a good area to research.

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]