Examining And Bypassing The IE8 XSS Filter

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address]

About Me ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Disclaimer ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals & Rationale ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals ,[object Object],[object Object],[object Object],[object Object],[object Object]

Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Un-Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Enabling / Disabling the XSS Filter ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Logic Flow Flow Chart stolen from http://blogs.technet.com/swi/archive/2008/08/18/ie-8-xss-filter-architecture-implementation.aspx

Navigation to HTML? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object]

Signature Match Against the Body ,[object Object],[object Object],[object Object],[object Object],[object Object]

Neuter Characters ,[object Object],[object Object],[object Object],[object Object]

Intro’s over - Lets talk Bypasses ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Fragmented Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML-Only Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site Check Bypass via GET ,[object Object],[object Object],[object Object],[object Object],[object Object]

JavaScript-based tricks for injections into JavaScript strings ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Unfiltered injections into HTML ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

OBJECT Extension Sniffing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Stripping data that isn’t actually attacker controlled ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object]

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address] Thanks to David Ross, et al for making something fun to play with

References – MS Design Info ,[object Object],[object Object],[object Object],[object Object]

References – Bypass Tricks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Examining And Bypassing The IE8 XSS Filter

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (6)

Similaire à Examining And Bypassing The IE8 XSS Filter

Similaire à Examining And Bypassing The IE8 XSS Filter (20)

Dernier

Dernier (20)

Examining And Bypassing The IE8 XSS Filter