Comments on: XSS is art

By: thornmaker

thornmaker — Thu, 02 Oct 2008 00:22:31 +0000

true, but i liked the string of dots for aesthetic reasons. i’ve looked around for some other built in functions that work like this but haven’t found anything yet. you?

By: Gareth Heyes

Gareth Heyes — Wed, 01 Oct 2008 07:07:21 +0000

Nice!

Can be shortened too
‘xalert(0)x’.replace(/[^x]+/,eval)

By: thornmaker

thornmaker — Tue, 30 Sep 2008 23:10:31 +0000

The opera trick you showed me earlier today also works in FF3 provided you use eval:

‘xalert(0)x’.replace(/a……./,eval)

By: Spletno gostovanje

Spletno gostovanje — Wed, 24 Sep 2008 11:09:10 +0000

XSS… it really is an art…

I agree

By: Erik

Erik — Mon, 15 Sep 2008 14:09:13 +0000

i think xss it’s art too :xD

By: DoctorDan

DoctorDan — Fri, 12 Sep 2008 22:10:38 +0000

Oh, you tricky, tricky man.
XSS is art, and in this case is certainly beauty as well

By: Gilzow

Gilzow — Fri, 12 Sep 2008 20:59:29 +0000

ok, NOW it makes more sense. I noticed that the smoke-screen was saying that it had detected an injection. Thanks for the clarification.

*Very* interesting stuff that you are coming up with. Let’s hope the REAL bad guys are two steps behind you.

By: Gareth Heyes

Gareth Heyes — Fri, 12 Sep 2008 18:25:59 +0000

Yeah that’s because Mario already fixed it

Here’s a demo of how it did work:-
demo

By: Gilzow

Gilzow — Fri, 12 Sep 2008 17:01:18 +0000

ok, i see now where name comes into play, but the link to the payload, in firefox, doesnt fire off the alert. So i’m still a bit confused…

By: Gareth Heyes

Gareth Heyes — Fri, 12 Sep 2008 15:41:34 +0000

@Gilzow

thanks

I didn’t include the actual payload until later which uses window.name. It can be passed from site to site so it’s a good way of passing a XSS payload.

Line 5 does nothing it is there to get round phpids centrifuge detection. Centrifuge detects vectors when they look like previous ones. The toolbar reference is window.toolbar in Firefox and is used to again bypass centrifuge, any global object/function can be called on one line like this.

Look at comment 4 to see how window.name can be passed as a payload.