the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 459
Dynamically Evaluated Styles
Some browsers support the use of JavaScript within dynamically evaluated
CSS styles. The following example works on IE7 and earlier, and also on later
versions when running in compatibility mode:
Later versions of IE removed support for the preceding syntax, on the basis
that its only usage in practice was in XSS attacks. However, on later versions of
IE, the following can be used to the same effect:
The Firefox browser used to allow CSS-based attacks via the moz-binding
property, but restrictions made to this feature mean that it is now less useful
in most XSS scenarios.
Bypassing Filters: HTML
The preceding sections described numerous ways in which script code can be
executed from within an HTML page. In many cases, you may find that signaturebased
filters can be defeated simply by switching to a different, lesser-known
method of executing script. If this fails, you need to look at ways of obfuscating
your attack. Typically you can do this by introducing unexpected variations
in your syntax that the filter accepts and that the browser tolerates when the
input is returned. This section examines the ways in which HTML syntax can
be obfuscated to defeat common filters. The following section applies the same
principles to JavaScript and VBScript syntax.
Signature-based filters designed to block XSS attacks normally employ regular
expressions or other techniques to identify key HTML components, such as tag
brackets, tag names, attribute names, and attribute values. For example, a filter
may seek to block input containing HTML that uses specific tag or attribute
names known to allow the introduction of script, or it may try to block attribute
values starting with a script pseudo-protocol. Many of these filters can be
bypassed by placing unusual characters at key points within the HTML in a
way that one or more browsers tolerate.
To see this technique in action, consider the following simple exploit:
You can modify this syntax in numerous ways and still have your code execute
on at least one browser. We will examine each of these in turn. In practice, you
may need to combine several of these techniques in a single exploit to bypass
more sophisticated input filters.