Examining And Bypassing The IE8 XSS Filter

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address]

About Me ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Disclaimer ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals & Rationale ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Goals ,[object Object],[object Object],[object Object],[object Object],[object Object]

Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Un-Protected Scenarios ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Enabling / Disabling the XSS Filter ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Filter Logic Flow Flow Chart stolen from http://blogs.technet.com/swi/archive/2008/08/18/ie-8-xss-filter-architecture-implementation.aspx

Navigation to HTML? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Heuristic matches against GET/POST ,[object Object],[object Object],[object Object],[object Object],[object Object]

Signature Match Against the Body ,[object Object],[object Object],[object Object],[object Object],[object Object]

Neuter Characters ,[object Object],[object Object],[object Object],[object Object]

Intro’s over - Lets talk Bypasses ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Fragmented Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML-Only Injections ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Same Site Check Bypass via GET ,[object Object],[object Object],[object Object],[object Object],[object Object]

JavaScript-based tricks for injections into JavaScript strings ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Unfiltered injections into HTML ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

OBJECT Extension Sniffing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Stripping data that isn’t actually attacker controlled ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object]

Examining and Bypassing the IE8 XSS Filter Alex Kouzemtchenko [email_address] Thanks to David Ross, et al for making something fun to play with

References – MS Design Info ,[object Object],[object Object],[object Object],[object Object]

References – Bypass Tricks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Examining And Bypassing The IE8 XSS Filter

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (6)

Similar to Examining And Bypassing The IE8 XSS Filter

Similar to Examining And Bypassing The IE8 XSS Filter (20)

Recently uploaded

Recently uploaded (20)

Examining And Bypassing The IE8 XSS Filter