Bypassing XSS filtering rules: Web Penetration test Advanced XSS Tutorial

I believe that all of you have had this experience when doing penetration testing, obviously an XSS loophole, but there are XSS filtering rules or WAF protection cause we can not successfully use, such as our input <scirpt>alert ("HI") </script> will be converted to <script>alert (>XSS detected<) </script>, so that our XSS does not take effect, here are a few simple ways to bypass XSS:

1. Bypassing MAGIC_QUOTES_GPC

Magic_quotes_gpc=on is a security setting in PHP that will rotate some special characters, such as ' (single quotes) to \, "(double quotes) to \, \ to \

For example: <script>alert ("XSS");</script> will be converted to <script>alert (\ "Xss\"), </script>, so that our XSS does not take effect.

For Web sites that open MAGIC_QUOTES_GPC, we can bypass the String.fromCharCode method in JavaScript, we can turn alert ("XSS") into

String.fromCharCode (97, 108, 101, 114, 116, 40, 34, 88, 83, 83, 34, 41) Then our XSS statement becomes

<script>string.fromcharcode (108, 114, 116, and the other, and the other, () </script>

String.fromCharCode () is a string method in JavaScript used to convert ASCII to a string.

How to convert ASCII code.

We can use the Hackbar to fix the Firefox extension tool https://addons.mozilla.org/en-US/firefox/addon/hackbar/

The final use of <script> conversion after the put here </script> contains can be. 2, Hex code

We can hex our statements to circumvent the XSS rules.

For example: <script>alert ("XSS");</script> can be converted to:

%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%78%73%73%22%29%3b%3c%2f%73%63%72%69%70%74%3e

Online tools:

Http://textmechanic.com/ASCII-Hex-Unicode-Base64-Converter.html

HTTP://WWW.ASCIITOHEX.COM/3, changing case

During the test, we can change the case of the test statement to circumvent the XSS rule

For example: <script>alert ("XSS");</script> can be converted to:

<script>alert ("XSS");</script> 4, closing label

Sometimes we need to close the tag to make our XSS effective, such as:

"><script>alert (" Hi ");</script>

Reference Address:

Http://www.breakthesecurity.com/2011/12/bypassing-xss-filters-advanced-xss.html

http://www.exploit-db.com/papers/15446/