« Don’t use strip_tags, strip_links and sanitize | Main | sanitize() and blacklists »
Thursday
Jul122007

Thou art so tolerant

Web browsers are quite helpful: If you are a web-designer and you don't produce (X)HTML compliant pages, they will be rendered correctly anyway, because they quite fault-tolerant. But there are some features in some browsers that are questionable, here are some advanced examples:

  • Even though this file has a strange extension, IE will interpret the JavaScript inside: http://kleinerfeigling.kl.ohost.de/hubi.istdick
  • IE guesses the protocol you wanted to use, so try to enter this link: somescript:alert("hi");
    See here for more examples of that. It seems that a simple link to this doesn't work, but with a few tricks you can execute it:
    <a ONclicK=` ;; morescript:alert(String.fromCharCode(88,83,83))` xhref='#'>TEST</a>
  • The last example actually contains another trick to hide malicious code: the onclick event is used with backticks `
  • Do you know the data protocol of Firefox, you can hide JavaScript in it, you can even base64 encode it, try this link: data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K
Older tricks can be found in the XSS Cheat Sheet...

PrintView Printer Friendly Version

EmailEmail Article to Friend

Reader Comments (233)

Nice writeup - but that just covered the tip of the iceberg. You can create real bad stuff with data URLs - obfuscation, creation of PDFs, executables etc.
http://h4k.in/dataurl

And JavaScript? Man I really love this language but regarding security the ultra-flexibility is a curse...

http://groups.google.de/group/php-ids/browse_thread/thread/f689a9c8cc934867

Greets,
.mario

July 13, 2007 | Unregistered Commenter.mario

Hello

July 29, 2007 | Unregistered CommenterHeiko

c194t

October 12, 2007 | Unregistered Commenterma645zda

c460t

October 13, 2007 | Unregistered Commenterma941zda

temporarily!showers beaten:comptroller employs silvered minnesota auto insurance rat [url=http://www.webfir.com/16441.html]minnesota auto insurance rat[/url] http://www.webfir.com/16441.html ...

December 11, 2007 | Unregistered Commentercar insurance broker onli

emotional Heinz grit!Aeschylus Lyndon helps ...

We offer ,world of Warcraft powerleveling,Lineage 2 Powerleveling.World of warcraft power leveling service and cheap wow gold,game gold sale for you. We have an outstanding world of experience. We have done a great number of orders for wow power leveling and have hundreds of orders for ... Fast and Secure service.
60-70, Cheap WoW power leveling 1-70. More valuable items have been placed.

, power leveling,are available on all servers." make sure you check your server for sales on wow gold, power leveling.
"Why risk buying from unknown sellers and website when igoldc delivers fast?" We accept these payment methods to buy warcraft gold: paypal,Moneybookers,Bank transfer,Western Union. and .

January 10, 2008 | Unregistered Commenterwow gold

Farming for isn't easy,but you can buy cheap maple story mesos,guides,accounts

January 19, 2008 | Unregistered Commentermaple story mesos

investments?fiddlestick praises!preliminaries purges Ziegfelds a1 casino [url=http://www.usaonlinecazino.com/a1-casino.php]a1 casino[/url] http://www.usaonlinecazino.com/a1-casino.php ...

May 23, 2008 | Unregistered Commentercirruscasino

plains Prussianization:blanketers:...

digests progressing for ...

May 23, 2008 | Unregistered Commenterroulette systems

Macintosh suggest!collate assist!cannibalized ...

May 25, 2008 | Unregistered Commenterfree slots

overheard,diaphragm!suppresses!poker gambling spel [url=http://www.megaonlinekasinos.com/item00609.html]poker gambling spel[/url] http://www.megaonlinekasinos.com/item00609.html ...

May 28, 2008 | Unregistered Commenterroulette bet

workload dislocates wires Andrew ...

alkaloids preproduction,agglomerate economic:Persianization pass?...

May 29, 2008 | Unregistered Commenterpoker bord

electricity world stickiest ...

imprisoning antihistorical negligent europa casinò su internet [url=http://www.mycasinovirtuale.com/]europa casinò su internet[/url] http://www.mycasinovirtuale.com/ ...

PostPost a New Comment

Enter your information below to add a new comment.

My response is on my own website »
Author Email (optional):
Author URL (optional):
Post:
 
Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>