Unveiling the Secrets of XSS Bypass: Harnessing JavaScript Symbols for Code Execution
Tags: xss, cybersecurity, infosec, vulnerabilities
Published: 2023-11-05 17:14:48

## Preface
I have been looking at Intigriti, yeswehack, HackerOne and Bugcrowd bounty platforms recently. It is really uncomfortable to bypass WAF. I will record the bypass scenario.

## Preliminary testing

When I first tried XSS, I found that the user's input is displayed in the title. Generally speaking, it is to see if it can be closed. As the picture below shows, it is converted into an entity after entering angle brackets.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7kt4fko4iz7q9djxjt5a.png)


## Bypass Html Entity Encoding

HTML entity encoding, which is the escape character in HTML.

In HTML, some characters are reserved. For example, the less than sign < and the greater than sign > cannot be used in HTML because the browser will mistake them for tags. If we want to display reserved characters correctly, we must use character entities in the HTML source code. A common character entity in HTML is a nonbreaking space. (Note: Entity names are case-sensitive!) Character entities are similar to this: &entity_name; or &#entity_number; If you need to display the less than sign, we must write like this: < or < Common entity encoding.

More entities can be found on the following website:

[The Basic Latin alphabet, 128 symbols (◕‿◕) SYMBL
](https://symbl.cc/en/unicode/blocks/basic-latin/#subblock-0061)
Continuing to try, we found that the title tag would close when we entered the html decimal entity number and escaped it.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r2y997ocgzv576jusjng.png)



## WAF
I originally thought of <img/src=1 onerror=alert(1) /> and directly killed it, but ended up with a waf.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7xej4rilzn591156lwdw.png)



The next step is to fuzz the event as usual, and the results are all 403. At this time, there is no other way, so the image tag cannot be used.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jnv52rcrrkgxopgl03ee.png)



Changing other tags, fuzz found that there are quite a few available.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j9hnoeytkqnlolbopi71.png)



Then use the tag to bypass

Commonly used payloads can be modified based on the following payloads


```
<a href="javascript:alert(1)"/>

```

It was going smoothly at first, but I posted it later and it was filtered. I really vomited. Just look at the picture.



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4llwha5pe7umslt6rg8w.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6nrw9c9rmeof7l6ykuiw.png)



Bypassing javascript, it’s here. Some people may think it’s over, but in fact it’s not that simple.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l7oczuuank4tdklmb0y5.png)



In fact, I didn’t spend much time in the front, mainly around the alert time. The various methods I tried here include html entity bypass, but basically, none of them worked.



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3x1ugs3ynwbg7sxaee3m.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/px7zz9aun78vf54bfv9a.png)




Then I was stuck here for a long time. I also thought about using prompt and other functions instead of alert, but it just didn't work. Later I found that brackets and backticks cannot be followed.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vofwirzxtwb7fh2qv1sj.png)




At this time, I was thinking, is there any function that cannot use parentheses to pop up windows? I'm totally confused. I searched a lot and couldn't find any of them. They all require brackets. I can't get past the ones that don't require brackets and backticks after the alert.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p7dy15n4mcyrzoidzz1l.png)



Finally saw this on some Twitter user on random waf bypass tips finally completing the bypass

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ge3u27h8jqizkvq3vm2f.png)



The Link:- [https://aem1k.com/aurebesh.js/#%60alert%281%29%60](https://aem1k.com/aurebesh.js/#%60alert%281%29%60
)
Local test payload


```
<a/href="javascript;{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a +e+s](e+s+v+h+n)(/infected/.source)" />click

```


```
<a href=ja
vascript:k='',a=!k+k,f=!a+k,g=k+{},kk=a[k++],ka=a[kf=k],kg =++kf+k,ak=g[kf+kg],a[ak+=g[k]+(a.f+g)[k]+f[kg]+kk+ka+a[kf]+ ak+kk+g[k]+ka][ak](f[k]+f[kf]+a[kg]+ka+kk+"(k)")()> 1111";//</title >
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gcd4lve8uodo06m2beo5.png)



---

Source :- https://tutorialboy24.blogspot.com/2023/11/unveiling-secrets-of-xss-bypass.html