the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 479
Content-Length: 1098
...
...
As mentioned, this exploit succeeds when the response is consumed directly
by the browser, and not by the original application component that would ordinarily
process the response.
Attacking Browser XSS Filters
One obstacle to the practical exploitation of virtually any reflected XSS vulnerability
arises from various browser features that attempt to protect users from
precisely these attacks. Current versions of the Internet Explorer browser include
an XSS filter by default, and similar features are available as plug-ins to several
other browsers. These filters all work in a similar way: they passively monitor
requests and responses, use various rules to identify possible XSS attacks in
progress, and, when a possible attack is identified, modify parts of the response
to neutralize the possible attack.
Now, as we have discussed, XSS conditions should be considered vulnerabilities
if they can be exploited via any browser in widespread usage, and the
presence of XSS filters in some browsers does not mean that XSS vulnerabilities
do not need to be fixed. Nevertheless, in some practical situations, an attacker
may specifically need to exploit a vulnerability via a browser that implements an
XSS filter. Furthermore, the ways in which XSS filters can be circumvented are
interesting in their own right. In some cases they can be leveraged to facilitate
the delivery of other attacks that otherwise would be impossible.
This section examines Internet Explorer’s XSS filter. Currently it is the most
mature and widely adopted filter available.
The core operation of the IE XSS filter is as follows:
n In cross-domain requests, each parameter value is inspected to identify
possible attempts to inject JavaScript. This is done by checking the value
against a regex-based blacklist of common attack strings.
n If a potentially malicious parameter value is found, the response is checked
to see whether it contains this same value.
n If the value appears in the response, the response is sanitized to prevent
any script from executing. For example, is modified to become
.