1

If a website URL gets encoded then is the website still vulnerable to XSS or no?

For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)%3C%2Fscript%3E does this mean the site is vulnerable to XSS or no?

jonroethke
  • 1,006
  • 2
  • 7
  • 21
Rifat Shommo
  • 51
  • 1
  • 1
  • 4
  • The answer depends on what the webapplication does with the URL-encoded payload. Are you assuming a scenario of the type `echo urlencode(payload)`? – Anders Sep 25 '18 at 10:55

2 Answers2

3

The answer depends on how the page renders your payload.

If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or Chrome's XSS auditor. However, if the HTML page renders your payload in the URL syntax i.e. %3Cscript%3Ealert(1)%3C%2Fscript%3E, there won't be an XSS. Depending on where the payload is injected in the latter, I would also try special characters like " and ' to try escape the URL context to inject directly into the HTML (url) tag.

isopach
  • 491
  • 1
  • 3
  • 14
  • The ``htmlentities()`` function and the ``htmlspecialchars()`` function, both of which I believe to be used in this parameter, will not allow escaping. – Cillian Collins Jul 27 '18 at 10:16
0

In that particular example, that parameter would not be vulnerable to XSS.

It does depend, you aren't giving a load of information, but generally speaking that seems to be something like: htmlspecialchars(htmlentities($input)) which is incredibly safe.

This does not mean that the SITE is not vulnerable, it just means that this parameter in particular seems to be safe.

This still depends, is the parameter injecting your input into a link, iframe, image, etc? If it is injecting within another element, it may be possible regardless using methods such as javascript: and data:.

Cillian Collins
  • 222
  • 1
  • 4
  • Actually my xss payloads was reflected on the page. The site Url encode my payloads like %3Cscript%3Ealert(1)%3C%2Fscript%3E – Rifat Shommo Jul 27 '18 at 00:11
  • 1
    In that case, they are using the ``htmlentities()`` function, but are printing it raw, which means it is also going through a function such as ``htmlspecialchars()``. This is not possible to get XSS in the way you described. Doesn't mean the entire site is secure, but it does mean this parameter would be. – Cillian Collins Jul 27 '18 at 10:15