Blocking Alert Effects
Page 1 of 1
Blocking Alert Effects
I’m always amazed at people who think that blocking alert() is actually an effective way to block cross site scripting. I’ve seen it myself, and it’s one of those things that never sounded right even the first time I saw it years ago. It sounds even less right, and here’s an email from a friend of mine, Jon McClintock:
I just got a nice XSS “win” that I thought I’d share with you. The app had an odd filter that would block JS calls to the alert() method.
So this (invalid JS) input got in:
That’s a great example - pointing to functions, but what about things like confirm(), or prompt()? Sure, maybe all those are blocked too, but come on…. it’s time to start addressing the problem, rather than trying to block one of the hundreds of ways someone can initiate the attack. Anyway, great example!
I just got a nice XSS “win” that I thought I’d share with you. The app had an odd filter that would block JS calls to the alert() method.
So this (invalid JS) input got in:
- Code:
";alert"xss";
But this didn’t:
";alert("xss");
The usual whitespace and comment tricks didn’t work either, and other useful methods, such as eval, were also blocked. So what do you do? Function pointer, of course:
";var foo=alert;foo("xss");
That’s a great example - pointing to functions, but what about things like confirm(), or prompt()? Sure, maybe all those are blocked too, but come on…. it’s time to start addressing the problem, rather than trying to block one of the hundreds of ways someone can initiate the attack. Anyway, great example!
andry- Moderator
- Posts : 467
Join date : 2010-05-07
Similar topics
» Social Media and Its Effects on SEO
» Windows XP: The Trojan Blocking OS?
» SEO Tips to overcome from Google Panda Update Effects
» Bypassing the intent of blocking "third-party" cookies
» Prevent Duplicate Content By Blocking Archives From Search Engines
» Windows XP: The Trojan Blocking OS?
» SEO Tips to overcome from Google Panda Update Effects
» Bypassing the intent of blocking "third-party" cookies
» Prevent Duplicate Content By Blocking Archives From Search Engines
Page 1 of 1
Permissions in this forum:
You cannot reply to topics in this forum
|
|