XSS Filter Evasion Cheat Sheet

 

 

XSS Filter Evasion Cheat Sheet

 

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

 

 

Last revision (mm/dd/yy): 01/6/2016

Introduction

 [hide] 

• 1 Introduction
• 2 Tests
  • 2.1 XSS Locator
  • 2.2 XSS Locator (short)
  • 2.3 No Filter Evasion
  • 2.4 Image XSS using the JavaScript directive
  • 2.5 No quotes and no semicolon
  • 2.6 Case insensitive XSS attack vector
  • 2.7 HTML entities
  • 2.8 Grave accent obfuscation
  • 2.9 Malformed A tags
  • 2.10 Malformed IMG tags
  • 2.11 fromCharCode
  • 2.12 Default SRC tag to get past filters that check SRC domain
  • 2.13 Default SRC tag by leaving it empty
  • 2.14 Default SRC tag by leaving it out entirely
  • 2.15 On error alert
  • 2.16 IMG onerror and javascript alert encode
  • 2.17 Decimal HTML character references
  • 2.18 Decimal HTML character references without trailing semicolons
  • 2.19 Hexadecimal HTML character references without trailing semicolons
  • 2.20 Embedded tab
  • 2.21 Embedded Encoded tab
  • 2.22 Embedded newline to break up XSS
  • 2.23 Embedded carriage return to break up XSS
  • 2.24 Null breaks up JavaScript directive
  • 2.25 Spaces and meta chars before the JavaScript in images for XSS
  • 2.26 Non-alpha-non-digit XSS
  • 2.27 Extraneous open brackets
  • 2.28 No closing script tags
  • 2.29 Protocol resolution in script tags
  • 2.30 Half open HTML/JavaScript XSS vector
  • 2.31 Double open angle brackets
  • 2.32 Escaping JavaScript escapes
  • 2.33 End title tag
  • 2.34 INPUT image
  • 2.35 BODY image
  • 2.36 IMG Dynsrc
  • 2.37 IMG lowsrc
  • 2.38 List-style-image
  • 2.39 VBscript in an image
  • 2.40 Livescript (older versions of Netscape only)
  • 2.41 SVG object tag
  • 2.42 BODY tag
  • 2.43 Event Handlers
  • 2.44 BGSOUND
  • 2.45 & JavaScript includes
  • 2.46 STYLE sheet
  • 2.47 Remote style sheet
  • 2.48 Remote style sheet part 2
  • 2.49 Remote style sheet part 3
  • 2.50 Remote style sheet part 4
  • 2.51 STYLE tags with broken up JavaScript for XSS
  • 2.52 STYLE attribute using a comment to break up expression
  • 2.53 IMG STYLE with expression
  • 2.54 STYLE tag (Older versions of Netscape only)
  • 2.55 STYLE tag using background-image
  • 2.56 STYLE tag using background
  • 2.57 Anonymous HTML with STYLE attribute
  • 2.58 Local htc file
  • 2.59 US-ASCII encoding
  • 2.60 META
    • 2.60.1 META using data
    • 2.60.2 META with additional URL parameter
  • 2.61 IFRAME
  • 2.62 IFRAME Event based
  • 2.63 FRAME
  • 2.64 TABLE
    • 2.64.1 TD
  • 2.65 DIV
    • 2.65.1 DIV background-image
    • 2.65.2 DIV background-image with unicoded XSS exploit
    • 2.65.3 DIV background-image plus extra characters
    • 2.65.4 DIV expression
  • 2.66 Downlevel-Hidden block
  • 2.67 BASE tag
  • 2.68 OBJECT tag
  • 2.69 Using an EMBED tag you can embed a Flash movie that contains XSS
  • 2.70 You can EMBED SVG which can contain your XSS vector
  • 2.71 Using ActionScript inside flash can obfuscate your XSS vector
  • 2.72 XML data island with CDATA obfuscation
  • 2.73 Locally hosted XML with embedded JavaScript that is generated using an XML data island
  • 2.74 HTML+TIME in XML
  • 2.75 Assuming you can only fit in a few characters and it filters against ".js"
  • 2.76 SSI (Server Side Includes)
  • 2.77 PHP
  • 2.78 IMG Embedded commands
    • 2.78.1 IMG Embedded commands part II
  • 2.79 Cookie manipulation
  • 2.80 UTF-7 encoding
  • 2.81 XSS using HTML quote encapsulation
  • 2.82 URL string evasion
    • 2.82.1 IP verses hostname
    • 2.82.2 URL encoding
    • 2.82.3 Dword encoding
    • 2.82.4 Hex encoding
    • 2.82.5 Octal encoding
    • 2.82.6 Mixed encoding
    • 2.82.7 Protocol resolution bypass
    • 2.82.8 Google "feeling lucky" part 1.
    • 2.82.9 Google "feeling lucky" part 2.
    • 2.82.10 Google "feeling lucky" part 3.
    • 2.82.11 Removing cnames
    • 2.82.12 Extra dot for absolute DNS:
    • 2.82.13 JavaScript link location:
    • 2.82.14 Content replace as attack vector
  • 2.83 Character escape sequences
• 3 Character Encoding and IP Obfuscation Calculators
• 4 Authors and Primary Editors
• 5 Contributors
• 6 Other Cheatsheets