I've tried almost any combination

5ail0rn00b314
5 years ago

0

i tried filling in the textbox with the examples from
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
and i’ve been through a lot of them.
but i cant seem to find it.

Maybe im doing something wrong. does anyone have a tip for me that can bring me on the good path?

7replies
4voices
233views
Darwin [DIDIx13]
5 years ago

0

Finding the Owasp cheat sheet is a good thing but the most important part is understanding what each payload does and how do we expect the browser to react.

Here the challenge asks us to execute exactly this code:

So we don’t need a huge XSS payload, we just want the server to execute this piece of code. So try to execute it and bypass the filter :)

5ail0rn00b314
5 years ago

0

I already saw that the filter filters out when i replace the brackets with asciii it shows me the complete string but it does not execute.. could you give me a hint for where to look for?

HAL [VileAnnie]
5 years ago

0

As @DIDIx13 says, you have to stick to the challenge. At this time, no need to dig so deep, even if Owasp is a good reading :)
Maybe you could first think about how the filter does the job, then only in a second time find how to bypass it.

Darwin [DIDIx13]
5 years ago

0

Let me PM you

5ail0rn00b314
5 years ago

0

I know it filters out the tags. and i see that it doesn’t recognize the script because it’s in the textarea. i already tried to step out of it by using but without succes.

Kaldah
5 years ago | edited 5 years ago

0

I think you should try to understand what the filter does exactly to what you send. Then you should be able to guess how to bypass it easily. I hope it will help you ^^

5ail0rn00b314
5 years ago

0

found it thanks to the help of @DIDIx13.
thanks everyone for your support.

I’ve found this website + community very helpful so far.
And i would like to thank each and everyone of you guys.

Discussion thread has been locked. You can no longer add new posts.
1 of 8

This site only uses cookies that are essential for the functionality of this website. Cookies are not used for tracking or marketing purposes.

By using our site, you acknowledge that you have read and understand our Privacy Policy, and Terms of Service.

Dismiss