[WEB SECURITY] Need some help with one XSS Vector
davechintan at gmail.com
Fri May 18 02:34:59 EDT 2012
I am running into one issue with XSS and was interested if there is any way
I can bypass it.
Following the response code where user supplied input is embedded. Input is
taken via a text box.
User supplied input *1* is highlighted in red. I am trying to break out of
this alert box, however when a single quote is given as input, the output
is escaped using a backslash. It is as follows:
the card 1\'');</script>*
I am using IE 8 and tried using back ticks just to check if I can get
around this limitation, however it did not work.
Any suggestion on how to break out of this would be much helpful.
All characters except the *single quote, <!-- and </script>* are working.
I tried the following vector to escape out:
the card 1`);alert(1);(`');</script>
*Appreciate* *your help and support in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the websecurity