the-web-application-hackers-handbook

490 Chapter 12 n Attacking Users: Cross-Site Scripting
extract whatever comes next, up until the end of the URL. This behavior can
be exploited in two ways:
n If the server’s validation logic is being applied on a per-parameter basis,
rather than on the entire URL, the payload can be placed into an invented
parameter appended after the vulnerable parameter. For example:
http://mdsec.net/error/76/Error.ashx?message=Sorry%2c+an+error+occurr
ed&foo=alert(1)
Here, the server ignores the invented parameter, and so it is not subject to
any filtering. However, because the client-side script searches the query
string for message= and extracts everything following this, it includes your
payload in the string it processes.
n If the server’s validation logic is being applied to the entire URL, not
just to the message parameter, it may still be possible to evade the filter
by placing the payload to the right of the HTML fragment character (#):
http://mdsec.net/error/82/Error.ashx?message=Sorry%2c+an+error+
occurred#alert(1)
Here, the fragment string is still part of the URL. Therefore, it is stored
in the DOM and will be processed by the vulnerable client-side script.
However, because browsers do not submit the fragment portion of the
URL to the server, the attack string is not even sent to the server and
therefore cannot be blocked by any kind of server-side filter. Because the
client-side script extracts everything after message=, the payload is still
copied into the HTML page source.
TRY IT!
http://mdsec.net/error/76/
http://mdsec.net/error/82/
COMMON MYTH
“We check every user request for embedded script tags, so no XSS attacks are
possible.”
Aside from the question of whether any filter bypasses are possible, you
have now seen three reasons why this claim can be incorrect:
n In some XSS flaws, the attacker-controllable data is inserted directly into
an existing JavaScript context, so there is no need to use any script tags
or other means of introducing script code. In other cases, you can inject
an event handler containing JavaScript without using any script tags.