+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Bypassing XSS filters? (/showthread.php?tid=5460126)
Bypassing XSS filters? - Abducted - Nov 10, 2016
Hey, could anyone help me bypassing some browser XSS filters? If you think you might do it leave a post so I can shoot you a PM!
Cheers,
Abducted 🤝
* - libc - Nov 10, 2016
Find which characters the web application filters and construct a payload that doesn't contain them. Try the OWASP cheat sheet.
* - Abducted - Nov 10, 2016
(Nov 10, 2016 03:25 PM)libc Wrote: Find which characters the web application filters and construct a payload that doesn't contain them. Try the OWASP cheat sheet.
I was talking about browser XSS filters.
Sorry gonna update OP.
* - Straight Grizzly - Nov 10, 2016
(Nov 10, 2016 03:26 PM)Abducted Wrote: I was talking about browser XSS filters.
Sorry gonna update OP.
It depends on the browser entirely. When testing a web application, I test for XSS manually through Firefox because their filters seem to be the worst. You would still follow the same methodology that Libc has presented nonetheless
* - Abducted - Nov 10, 2016
(Nov 10, 2016 07:23 PM)Straight Grizzly Wrote: It depends on the browser entirely. When testing a web application, I test for XSS manually through Firefox because their filters seem to be the worst. You would still follow the same methodology that Libc has presented nonetheless
I need to get Chrome filters bypassed somehow. Thanks for the advice though!
* - LittleBobbyTables - Nov 10, 2016
(Nov 10, 2016 09:21 PM)Abducted Wrote: I need to get Chrome filters bypassed somehow. Thanks for the advice though!
Is this a personal test? If so, don't use Chrome.
Outside of that, what are you breaking out of?
* - Straight Grizzly - Nov 11, 2016
(Nov 10, 2016 09:21 PM)Abducted Wrote: I need to get Chrome filters bypassed somehow. Thanks for the advice though!
Google will provide a wealth of information for you. Knowing what version you need to bypass will help as well.
* - Fladrif - Nov 11, 2016
Have a look at "OWASP Xenotix XSS Exploit Framework" - its a great tool which emulates each of the major browsers, so you can see if your XSS would work on what browser, then start to home in on how to bypass Webkit/Chrome.
But I agree it is a bit of trial and error working out which characters are being filtered. @brutelogic on Twitter is a great resource.
* - HiddenEyE - Nov 11, 2016
OP shot me a PM, i can help you on this.
chrome has never been my challenge so far.
* - ๖ۣۜAnubis - Nov 13, 2016
Depends on the filters, if for example the filter replace "<" with "\<", you could change your input to "\<" and after the filter aplied, it would be "\\<", wich would work.