Examining And Bypassing The IE8 XSS Filter

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address]

About Me ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Disclaimer ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals & Rationale ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals ,[object Object],[object Object],[object Object],[object Object],[object Object]

Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Un-Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Enabling / Disabling the XSS Filter ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Logic Flow Flow Chart stolen from http://blogs.technet.com/swi/archive/2008/08/18/ie-8-xss-filter-architecture-implementation.aspx

Navigation to HTML? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object]

Signature Match Against the Body ,[object Object],[object Object],[object Object],[object Object],[object Object]

Neuter Characters ,[object Object],[object Object],[object Object],[object Object]

Intro’s over - Lets talk Bypasses ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Fragmented Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML-Only Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site Check Bypass via GET ,[object Object],[object Object],[object Object],[object Object],[object Object]

JavaScript-based tricks for injections into JavaScript strings ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Unfiltered injections into HTML ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

OBJECT Extension Sniffing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Stripping data that isn’t actually attacker controlled ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object]

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address] Thanks to David Ross, et al for making something fun to play with

References – MS Design Info ,[object Object],[object Object],[object Object],[object Object]

References – Bypass Tricks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Examining And Bypassing The IE8 XSS Filter

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (6)

Ähnlich wie Examining And Bypassing The IE8 XSS Filter

Ähnlich wie Examining And Bypassing The IE8 XSS Filter (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Examining And Bypassing The IE8 XSS Filter