the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 469
to use a different tag with a suitable event handler. Here, you should consider
all the techniques already discussed for dealing with signature-based filters,
including using layers of encoding, NULL bytes, nonstandard syntax, and
obfuscated script code. By modifying your input in the various ways described,
you may be able to devise an attack that does not contain any of the characters
or expressions that the filter is sanitizing and therefore successfully bypass it.
If it appears impossible to perform an attack without using input that is being
sanitized, you need to test the effectiveness of the sanitizing filter to establish
whether any bypasses exist.
As described in Chapter 2, several mistakes often appear in sanitizing filters.
Some string manipulation APIs contain methods to replace only the first instance
of a matched expression, and these are sometimes easily confused with methods
that replace all instances. So if is being stripped from your input, you
should try the following to check whether all instances are being removed:
alert(1)
In this situation, you should also check whether the sanitization is being
performed recursively:
alert(1)
Furthermore, if the filter performs several sanitizing steps on your input, you
should check whether the order or interplay between these can be exploited.
For example, if the filter strips recursively and then strips
recursively, the following attack may succeed:
alert(1)
When you are injecting into a quoted string in an existing script, it is common
to find that the application sanitizes your input by placing the backslash
character before any quotation mark characters you submit. This escapes your
quotation marks, preventing you from terminating the string and injecting
arbitrary script. In this situation, you should always verify whether the backslash
character itself is being escaped. If not, a simple filter bypass is possible.
For example, if you control the value foo in:
var a = ‘foo’;
you can inject:
foo\’; alert(1);//
This results in the following response, in which your injected script executes.
Note the use of the JavaScript comment character // to comment out the