How To Bypass Html Encoding For Xss

by

In this blog post, we will discuss how to bypass HTML encoding for Cross-Site Scripting (XSS) attacks. HTML
encoding is a common technique used by developers to prevent XSS attacks, but as a security researcher or
ethical hacker, you may need to know how to bypass it to test the security of a web application.

Understanding HTML Encoding

HTML encoding is the process of converting special characters, such as <,
>, and &, into their corresponding HTML entities, like
&lt;, &gt;, and &amp; respectively. This
prevents the browser from interpreting these characters as part of the HTML or JavaScript code, thus
preventing XSS attacks.

Bypassing HTML Encoding

To bypass HTML encoding, an attacker can use various techniques that exploit specific vulnerabilities or
weaknesses in the web application. Some of these techniques include:

  1. Using different character sets: If a web application does not properly validate user
    input or specify a consistent character set, an attacker can use different character sets to bypass
    HTML encoding. For example, using UTF-7 instead of UTF-8 can allow an attacker to execute an XSS attack
    like this:

    <script>alert('XSS')</script>

    In UTF-7, this could be encoded as:

    +ADw-script+AD4-alert('XSS')+ADw-/script+AD4-
  2. Exploiting JavaScript functions: An attacker can use JavaScript functions that
    interpret HTML entities as actual characters, such as innerHTML or eval(). For
    example, if a web application uses innerHTML to display user input, an attacker can
    bypass HTML encoding like this:<script>
    document.getElementById(‘output’).innerHTML = ‘&#60;script&#62;alert(&#39;XSS&#39;)&#60;/script&#62;’;
    </script>

    This will cause the browser to execute the injected alert('XSS') script.
  3. Using alternative syntax: Sometimes, web applications only encode specific characters,
    allowing an attacker to use alternative syntax to bypass HTML encoding. For example, if a web
    application only encodes < and > characters, an attacker can use
    the following syntax to execute an XSS attack:

    <img/src="x"/onerror=alert('XSS')>

Conclusion

Bypassing HTML encoding for XSS attacks is an important skill for security researchers and ethical hackers.
Understanding the different techniques and their underlying vulnerabilities can help you identify and
exploit weaknesses in web applications, ultimately making them more secure. Always remember to use these
techniques responsibly and only for testing purposes.