the-web-application-hackers-handbook

468 Chapter 12 n Attacking Users: Cross-Site Scripting
You can even nest these calls and ping-pong between the languages as required:
execScript(‘execScript
“alert(1)”,”javascript”’,”vbscript”);
As mentioned, VBScript is case-insensitive, allowing you to execute code in
contexts where your input is converted to uppercase. If you really want to call
JavaScript functions in these situations, you can use string manipulation functions
within VBScript to construct a command with the required case and then
execute this using JavaScript:
EXECSCRIPT(LCASE(“ALERT(1)”))
Using Encoded Scripts
On Internet Explorer, you can use Microsoft’s custom script-encoding algorithm
to hide the contents of scripts and potentially bypass some input filters:
This encoding was originally designed to prevent users from inspecting
client-side scripts easily by viewing the source code for the HTML page. It has
since been reverse-engineered, and numerous tools and websites will let you
decode encoded scripts. You can encode your own scripts for use in attacks via
Microsoft’s command-line utility srcenc in older versions of Windows.
Beating Sanitization
Of all the obstacles that you may encounter when attempting to exploit potential
XSS conditions, sanitizing filters are probably the most common. Here, the
application performs some kind of sanitization or encoding on your attack string
that renders it harmless, preventing it from causing the execution of JavaScript.
The most prevalent manifestation of data sanitization occurs when the application
HTML-encodes certain key characters that are necessary to deliver an
attack (so < becomes &lt; and > becomes &gt;). In other cases, the application
may remove certain characters or expressions in an attempt to cleanse your
input of malicious content.
When you encounter this defense, your first step is to determine precisely
which characters and expressions are being sanitized, and whether it is still
possible to carry out an attack without directly employing these characters
and expressions. For example, if your data is being inserted directly into an
existing script, you may not need to employ any HTML tag characters. Or, if
the application is removing tags from your input, you may be able