Friday, December 02, 2011

Double eval() for DOM based XSS


DOM based XSS are becoming relatively common with Web 2.0 and Ajax driven applications. DOM based applications are using eval() method to inject new stream into the existing DOM. In certain cases it is becoming tricky to pass on the values for pen-testing and to create an abuse/exploit scenario. Recently during consulting we came across different DOM based XSS and objective is to get a pop-up to confirm the vulnerability. If we get an eval call then it is possible to double eval-ing to convert text back into payload.

Here is a simple scenario; it can be complicated on case to case basis.
For example, we have following line in the code

eval('getProduct('+ koko.toString()+')');

Here “koko” is coming from URL or controlled by user. Hence, if we pass on the value in following URL it gets to the “getProduct” function.

Testing scenario is simple, it causes DOM based XSS with following condition.

We are passing payload terminating function, ending statement and commenting out rest of the script. We get a simple pop-up if we pass on following code.

But to prove a point if we want to craft any other payload where we need to send single quote, for example want to execute “document.getElementsByName('Login')” will not work since we have that single quote that will raise syntax error. For simplicity if we pass on alert(‘hi’), it will not work and we will not get popup in above scenario.

We get following error in the browser.

Error: syntax error
Source File: http://192.168.3.2/catalog.aspx?pid=3%27);elval(alert(%27hi%27));//
Line: 37, Column: 29
Source Code:
getProduct(3%27);elval(alert(%27hi%27));//)

Interestingly, we can leverage double eval() in this case, we pass on following payload and let’s see what happens…

It will avoid error and we will get a pop-up. What we did was simple, we used fromCharCode function and passed on decimal values for alert(‘hi’) here, first eval will convert it into string and second eval will execute the code. Hence, double eval can rescue while testing DOM based XSS.

Curiously I searched this trick on web if people are using it and came across this article - http://blogs.msdn.com/b/infopath/archive/2006/04/05/569338.aspx
Double eval() can be leveraged for string operations and concatenation.

43 comments:

Jeremy said...

Wouldn't escaping the single tick work too? As in:

http://192.168.3.2/catalog.aspx?pid=3);alert(\'test\');//

shreeraj said...

Nop. It will not work - going through URL browser will not process. It may work through POST params.

Error: illegal character
Source File: http://192.168.3.2/catalog.aspx?pid=2%27);alert(\%27hi\%27)//
Line: 37, Column: 23
Source Code:
getProduct(2%27);alert(\%27hi\%27)//)

Unknown said...

This is most informative and also this post most user friendly and super navigation to all posts... Thank you so much for giving this information to me.. 

automation anywhere training in chennai

automation anywhere training in bangalore

automation anywhere training in pune

automation anywhere online training

blueprism online training

rpa Training in sholinganallur

rpa Training in annanagar

iot-training-in-chennai

blueprism-training-in-pune

automation-anywhere-training-in-pune

jefrin said...

Really good to read this post
IOT training institute in chennai

suresh said...

Excellent Article. Thanks Admin
Data Science Training in Chennai

DevOps Training in Chennai

Hadoop Big Data Training

Python Training in Chennai

jefrin said...

Great blog very good to read
best matlab training in chennai

Sivanandhana Girish said...

Thanks for your efforts in sharing this post with us. This was really awesome. kindly keep continuing the great work.
Spoken English Classes in Chennai
IELTS Coaching in Chennai
English Speaking Classes in Mumbai
IELTS Classes in Mumbai
IELTS Coaching in Mumbai
IELTS Mumbai
Best IELTS Coaching in Mumbai
IELTS Center in Mumbai

Kapil Sharma said...

I am outstandingly glad to see this post. It is interesting and edifying. Such a lovely post, I am appreciative and I like this post. Moreover, I should need to share one thing which is a foundation for learning python, which is the most mentioning now every day. For that, you can join at this association

Pythan Training in Greater Noida
Pythan coaching in Greater Noida
Pythan institute in Greater Noida
Pythan classes in Greater Noida


Vivek said...

Thangs for shareing this Blog I am very happy to see this such a valuable

information, you are doing good job keep continue on Blogging job here you can do

C++ Training in Greater Noida at Mirorsoft Technologies It can be used for low-

level programming, such as writing scripts for drivers and kernels, and also

supports high-level programming language functions, such as writing scripts for

software applications, etc.
C++ Language Training In Greater Noida
C++ Language Training Institute In Greater Noida
C++ Language Course In Greater Noida
C++ Language Classes In Greater Noida

Vivek said...

Thangs for shareing this Blog I am very happy to see this such a valuable

information, you are doing good job keep continue on Blogging job here you can do

C++ Training in Greater Noida at Mirorsoft Technologies It can be used for low-

level programming, such as writing scripts for drivers and kernels, and also

supports high-level programming language functions, such as writing scripts for

software applications, etc.
C++ Language Training In Greater Noida
C++ Language Training Institute In Greater Noida
C++ Language Course In Greater Noida
C++ Language Classes In Greater Noida

htop said...

thank you so much for sharing this useful message to us
best java training in chennai
best python training in chennai
selenium training in chennai
selenium training in omr
selenium training in sholinganallur

priyanka usha said...

This is really a great information about this technology.
IoT Training in Chennai
Internet of Things Training in Chennai
TOEFL Training in Chennai
french courses in chennai
Best Spoken English Class in Chennai
IELTS Training in Chennai
IoT Training in Velachery
German classes in anna nagar
spoken english class anna nagar

gaurav kashyap said...

This is a decent post. This post gives genuinely quality data. I'm certainly going to investigate it. Actually quite valuable tips are given here. Much obliged to you to such an extent. Keep doing awesome. To know more information about
Contact us :- https://www.login4ites.com/

gaurav kashyap said...

It is brilliant substance. I for the most part visit numerous locales however your site has something unique highlights. I for the most part visit on your site. Best Seo Tips
Contact us- https://myseokhazana.com

luckys said...

english to hindi typing   

Ramesh Gude said...

Nice blog.
Best institute for data scientist course institute in Bangalore

Prwatech said...

Thanks for sharing.It is good to see the greatest details presented in an easy and understandable manner.Keep posting more.
best institutes for big data training in Bangalore

Realtime Experts said...

well said about Static Access to Context outside of an Activity orAutomation Anywhere Training .Automation Anywhere Training in Bangalore

ammu said...

excellent blogs.....!!!
chile web hosting
colombia web hosting
croatia web hosting
cyprus web hosting
bahrain web hosting
india web hosting
iran web hosting
kazakhstan web hosting
korea web hosting
moldova web hosting

Rashika said...

Good article! I found some useful educational information in your blog about Automation Anywhere, it was awesome to read, thanks for sharing this great content to my vision.
Java training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery

Saqib Mirza said...

Top 2020 Digital Marketing agency in North Carolina Are offering web design and development services in low prices our prices are 10 times lower than the other USA companies our main priority is our client

IT Technology Updates said...

Nice Blog..Thanks for sharing..

dot net training in chennai
microstrategy training in chennai
ab initio training in chennai

Damien Grant said...

http://digitalweekday.com/
【回上頁】
【回上頁】
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/
http://digitalweekday.com/

radhika said...

This is excellent information. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me...

AWS training in Chennai

AWS Online Training in Chennai

AWS training in Bangalore

AWS training in Hyderabad

AWS training in Coimbatore

AWS training

OGEN Infosystem (P) Limited said...

Thank you so much for sharing your brilliant thoughts with us. Visit Ogen Infosystem for professional Web Designing and SEO Services in Delhi, India.
Website Designing Company in Delhi

Village Talkies said...

Thanks for sharing
Village Talkies a top-quality professional corporate video production company in Bangalore and also best explainer video company in Bangalore & animation video makers in Bangalore, Chennai, India & Maryland, Baltimore, USA provides Corporate & Brand films, Promotional, Marketing videos & Training videos, Product demo videos, Employee videos, Product video explainers, eLearning videos, 2d Animation, 3d Animation, Motion Graphics, Whiteboard Explainer videos Client Testimonial Videos, Video Presentation and more for all start-ups, industries, and corporate companies. From scripting to corporate video production services, explainer & 3d, 2d animation video production , our solutions are customized to your budget, timeline, and to meet the company goals and objectives.
As a best video production company in Bangalore, we produce quality and creative videos to our clients.

Digital Marketing Course in Bangalore said...

It is always so interesting to visit your site. What a great information, thanks for sharing. it will help me a lot in my learning.
Digital Marketing Course in Bangalore

Bhuvana said...

The Extraordinary blog went amazed by the content that they have developed in a very descriptive manner. This type of content surely ensures the participants explore themselves.

Data Science Training in Hyderabad

Data Science Training in Hyderabad said...

Good work, unique site and interesting too… keep it up…looking forward for more updates. Good luck to all of you and thanks so much for your hard-work…

Data Science Training in Hyderabad

NT said...

I'm writing on this topic these days, 메이저사이트, but I have stopped writing because there is no reference material. Then I accidentally found your article. I can refer to a variety of materials, so I think the work I was preparing will work! Thank you for your efforts.


Tamil novels said...

Excellent article. Thanks for sharing.
Tamil novel writers
Ramanichandran novels PDF
srikala novels PDF
Mallika manivannan novels PDF
muthulakshmi raghavan novels PDF
Infaa Alocious Novels PDF
N Seethalakshmi Novels PDF
Sashi Murali Tamil Novels PDF Download

Solitairian City Reviews and Complaints said...

Thanks for sharing such a great information with us. Your Post is very unique and all information is reliable for new readers. I am very glad to see this post. It is very interesting and informative.
Solitairian Review
Solitairian Review

data science said...

It is perfect chance to make a couple of game plans for the future and the opportunity has arrived to be sprightly. I've scrutinized this post and if I may I have the option to need to suggest you some interesting things or recommendations. Perhaps you could create next articles insinuating this article. I have to examine more things about it!

PMP Training in Malaysia said...

360DigiTMG, the top-rated organisation among the most prestigious industries around the world, is an educational destination for those looking to pursue their dreams around the globe. The company is changing careers of many people through constant improvement, 360DigiTMG provides an outstanding learning experience and distinguishes itself from the pack. 360DigiTMG is a prominent global presence by offering world-class training. Its main office is in India and subsidiaries across Malaysia, USA, East Asia, Australia, Uk, Netherlands, and the Middle East.

360DigiTMG said...

It is the perfect time to make some plans for the future and it is the time to be happy. I've read this post and if I could I would like to suggest some interesting things or suggestions. Perhaps you could write the next articles referring to this article. I want to read more things about it!
data analytics courses in hyderabad with placements

traininginstitute said...

Thanks for your post. I’ve been thinking about writing a very comparable post over the last couple of weeks, I’ll probably keep it short and sweet and link to this instead if thats cool. Thanks.
cyber security course malaysia

Professional Career Technology said...

Very impressive!!! When I searched for this, I found this website at the top of all the blogs in the search engines.

Business Analytics Course

Professional Career Technology said...

Enroll in the Data Science course near me to learn the handling of huge amounts of data by analyzing it with the help of analytical tools. This field offers ample job profiles to work as a Data Architect, Data Administrator, Data Analyst, Business Analyst, Data Manager, and BI Manager. Step into an exciting career in the field of Data Science and achieve great heights by acquiring the right knowledge and skills to formulate solutions to business problems.

Data Science Course in Bangalore with Placement

Links For You said...

lovely information perform article. This announce is as a matter of fact the top notch cruelly this imperative circumstance. Office 365 Keygen

jahanzaib33 said...

The fact that we are no more together will never take away the fact that you will always be special to my heart. Quotes For Your Ex Boyfriend

Hurrain said...

This post is good because it has a lot of good points.
https://getcrackpc.com/rawtherapee-crack/

kteen187 said...

Thanks for giving great kind of information.
www.mehartravels.com

OnlineReviews said...

Thanks for giving great kind of information.RR Technosoft is the Devops training in hyderabad and it provides Class room & Online Training by real time faculty with course material and Lab Facility.