XSS filter/WAF evasion through invalid escapes
(2 minute read)
Most of the time, WAFs and XSS filters look for specific keywords to detect invocation of dangerous functions or variables.
/page?parameter=alert()
403 FORBIDDEN
A very common bypass technique is to break these specific character sequences like this:
window.alert() can also be written using square-bracket notation: window['alert']()
This is very useful because now the alert method is a string, this means that it can be obfuscated using all kinds of string functions:
window['ale' + 'rt'](1)
window['alexrt'.replace(/x/,'')](1)
Several years ago I found a nice feature in javascript that allows the attacker to break character sequences in a very easy, quick and shorter way. This is done by escaping characters that do not have an escape sequence assigned. For instance, these are valid escapes in javascript:
\' Simple quote
\" Double doble
\ Backslash
\n New line
\r Carriage return
\v Vertical tab
\t Tab
\b Backspace
\f Page forward
Those characters will be escaped to their corresponding values if you add a backslash before them.
If you use a backslash before any other character javascript will simply ignore the backslashes, so the string will be broken while still preserving its meaning:
window['\a\l\ert'](1)
window['\pr\o\m\pt'](1)
Hopefully this will help to speed-up the process of evading WAFs.
Filed under: Hacking,Web Application Security,XSS - @ 2023-07-28 18:11