Contents
Is it possible to exploit XSS without sanitization?
Without sanitization and validation of what a user put in the user arg, it would be possible to exploit a reflected XSS with a simple injection like /?user=foo’);alert (‘XSS. There’re two important things in this specific scenario:
Are there any difficulties in preventing XSS vulnerabilities?
One of the primary difficulties in preventing XSS vulnerabilities is proper character encoding. In some cases, the web server or the web application could not be filtering some encodings of characters, so, for example, the web application might filter out
Do you have to use encode syntax for XSS?
So even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the encode syntax for the part of the HTML document you’re putting untrusted data into. That’s what the rules below are all about.
Is there a way to prevent XSS in JavaScript?
It may appear a good injection killer to convert characters such as a single quote, double quotes, semicolon, etc… to their respective HTML entity codes, but in the JavaScript context it isn’t always a good way to prevent stored or reflected XSS. Quoting the OWASP Cross Site Scripting Prevention Cheat Sheet:
Where can I find a reflected XSS vulnerability?
XSS vulnerability occurs in those websites which take input from the user and while reflecting back in the browser they don’t perform any sanitization or content encoding. Sanitization means removing some unwanted characters like >, <, “,”, %, etc. from the input string.
How to bypass filters and sanitization in XSS?
If you use ModSecurity of course you know that is easy to fix this kind of bypass by using the transformation functions removeWhitespace ( removes all whitespace characters from input) and removeCommentsChar ( removes common comments chars such as: /*, */, –, #) as the following example:
How can XSS be used as payload on a vulnerable web application?
Used as payload on our vulnerable web application, we can exploit the XSS bypassing both HTML entities encoding and Web Application Firewall rule: Moreover, this operator should be used to bypass other “bad word” based WAF rules such as document.cookie with document ?. cookie.