the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 465
For input1, the application blocks input containing quotation marks to prevent
an attacker from terminating the quoted attribute. For input2, the application
blocks input containing angle brackets to prevent an attacker from using any
HTML tags. This appears to be robust, but an attacker may be able to deliver
an exploit using the following two inputs:
input1: [%f0]
input2: “onload=alert(1);
In the Shift-JIS character set, various raw byte values, including 0xf0, are used
to signal a 2-byte character that is composed of that byte and the following byte.
Hence, when the browser processes input1, the quotation mark following the
0xf0 byte is interpreted as part of a 2-byte character and therefore does not delimit
the attribute value. The HTML parser continues until it reaches the quotation
mark supplied in input2, which terminates the attribute, allowing the attacker’s
supplied event handler to be interpreted as an additional tag attribute:
... “onload=alert(1);
When exploits of this kind were identified in the widely used multibyte
character set UTF-8, browser vendors responded with a fix that prevented the
attack from succeeding. However, currently the same attack still works on some
browsers against several other lesser-used multibyte character sets, including
Shift-JIS, EUC-JP, and BIG5.
Bypassing Filters: Script Code
In some situations, you will find a way to manipulate reflected input to introduce
a script context into the application’s response. However, various other obstacles
may prevent you from executing the code you need to deliver an actual attack.
The kind of filters you may encounter here typically seek to block the use of
certain JavaScript keywords and other expressions. They may also block useful
characters such as quotes, brackets, and dots.
As with the obfuscation of attacks using HTML, you can use numerous
techniques to modify your desired script code to bypass common input filters.
Using JavaScript Escaping
JavaScript allows various kinds of character escaping, which you can use to
avoid including required expressions in their literal form.
Unicode escapes can be used to represent characters within JavaScript keywords,
allowing you to bypass many kinds of filters:
a\u006cert(1);
If you can make use of the eval command, possibly by using the preceding
technique to escape some of its characters, you can execute other commands
by passing them to the eval command in string form. This allows you to