Pages: [1]

Author Topic: Bypass htmlspecialchars  (Read 8270 times)

0 Members and 1 Guest are viewing this topic.

Offline benjikt

  • NULL
  • Posts: 2
  • Cookies: 0
    • View Profile
Bypass htmlspecialchars
« on: December 04, 2013, 05:33:32 pm »
Hi everyone, :) can you tell me how to bypass htmlspecialchars, search in google but nothing then can help me , i just try with small html form and one text field  php code:

Code: (php) [Select]
<?php
if(isset($_POST['go']))
{
     echo htmlspecialchars($_POST['text']);
}
?>
« Last Edit: December 04, 2013, 07:07:38 pm by Kulverstukas »
Report to moderator   Logged

Offline ande

  • Owner
  • Titan
  • *
  • Posts: 2664
  • Cookies: 256
    • View Profile
Re: Bypass htmlspecialchars
« Reply #1 on: December 04, 2013, 06:50:42 pm »
What do you mean bypass? As in bypass it to create an XSS? Not possible afaik. htmlspecialchars() is made for this exact purpose, filter/convert "bad" characters often used in XSS. Personally I use htmlentities() instead of htmlspecialchars().
Report to moderator   Logged
if($statement) { unless(!$statement) { // Very sure } }
https://evilzone.org/?hack=true

Kanade

  • Guest
Re: Bypass htmlspecialchars
« Reply #2 on: December 04, 2013, 07:18:37 pm »
It is not possible, unless the page uses UTF-7. (/dated URI)
For htmlentities () it is bypassable if he is badly configured, for example with:

 .' onevent ='prompt(/XSS/);
Report to moderator   Logged

Offline benjikt

  • NULL
  • Posts: 2
  • Cookies: 0
    • View Profile
Re: Bypass htmlspecialchars
« Reply #3 on: December 04, 2013, 08:33:37 pm »
ok and what is the conclusion, when use PDO and htmlspecialchars, my system is 100% protected ? , i mean how to make a xss when this thing use?
Sorry for my bad English :)
Report to moderator   Logged

Offline ande

  • Owner
  • Titan
  • *
  • Posts: 2664
  • Cookies: 256
    • View Profile
Re: Bypass htmlspecialchars
« Reply #4 on: December 04, 2013, 09:39:22 pm »
Using PDO does not guarantee security. If you use PDO correctly on the other hand, binding parameters with bindParam/bindValue or sending them as an array to the execute function you are secure.

Quote from http://php.net/manual/en/function.htmlspecialchars.php

Quote
a common confusion among beginner is that what is the difference between htmlentities() and htmlspecialchars() really, because the manual examples are converting angular brackets for both.

well, htmlentities() will ALSO look for other language characters in the string e.g German, French or Italian etc. So if you think your attacker can use some foreign language characters for a XSS attack in URL etc then use htmlentities() instead of htmlspecialchars().

I hope it helps,

Haroon Ahmad

But if you use htmlentities() instead you probably want to read this: (quote from http://php.net/manual/en/function.htmlentities.php)

Quote
An important note below about using this function to secure your application against Cross Site Scripting (XSS) vulnerabilities.

When printing user input in an attribute of an HTML tag, the default configuration of htmlEntities() doesn't protect you against XSS, when using single quotes to define the border of the tag's attribute-value. XSS is then possible by injecting a single quote:

<?php
$_GET['a'] = "#000' onload='alert(document.cookie)";
?>

XSS possible (insecure):

<?php
$href = htmlEntities($_GET['a']);
print "<body bgcolor='$href'>"; # results in: <body bgcolor='#000' onload='alert(document.cookie)'>
?>

Use the 'ENT_QUOTES' quote style option, to ensure no XSS is possible and your application is secure:

<?php
$href = htmlEntities($_GET['a'], ENT_QUOTES);
print "<body bgcolor='$href'>"; # results in: <body bgcolor='#000' onload='alert(document.cookie)'>
?>

The 'ENT_QUOTES' option doesn't protect you against javascript evaluation in certain tag's attributes, like the 'href' attribute of the 'a' tag. When clicked on the link below, the given JavaScript will get executed:

<?php
$_GET['a'] = 'javascript:alert(document.cookie)';
$href = htmlEntities($_GET['a'], ENT_QUOTES);
print "<a href='$href'>link</a>"; # results in: <a href='javascript:alert(document.cookie)'>link</a>
?>
Report to moderator   Logged
if($statement) { unless(!$statement) { // Very sure } }
https://evilzone.org/?hack=true

Offline proxx

  • Avatarception
  • Global Moderator
  • Titan
  • *
  • Posts: 2803
  • Cookies: 256
  • ФФФ
    • View Profile
Re: Bypass htmlspecialchars
« Reply #5 on: December 05, 2013, 11:34:57 am »
Quote from: benjikt on December 04, 2013, 08:33:37 pm
ok and what is the conclusion, when use PDO and htmlspecialchars, my system is 100% protected ? , i mean how to make a xss when this thing use?
Sorry for my bad English :)

Apart from all of this jazz; even saying something like  '100% protected' is an illusion.
Report to moderator   Logged
Wtf where you thinking with that signature? - Phage.
This was another little experiment *evillaughter - Proxx.
Evilception... - Phage

Offline lucid

  • #Underground
  • Titan
  • **
  • Posts: 2683
  • Cookies: 243
  • psychonaut
    • View Profile
Re: Bypass htmlspecialchars
« Reply #6 on: December 05, 2013, 11:36:43 am »
Quote from: proxx on December 05, 2013, 11:34:57 am
'100% protected'
Saying this statement anywhere, at anytime, about anything, is pure illusion
« Last Edit: December 05, 2013, 11:37:48 am by lucid »
Report to moderator   Logged
"Hacking is at least as much about ideas as about computers and technology. We use our skills to open doors that should never have been shut. We open these doors not only for our own benefit but for the benefit of others, too." - Brian the Hacker

Quote
15:04  @Phage : I'm bored of Python

Offline chapp

  • Peasant
  • *
  • Posts: 87
  • Cookies: 2
    • View Profile
Re: Bypass htmlspecialchars
« Reply #7 on: December 05, 2013, 10:30:26 pm »
Quote from: lucid on December 05, 2013, 11:36:43 am
Saying this statement anywhere, at anytime, about anything, is pure illusion


Well no it isn't and it's a common misconception to think so. Chances are that every system with more than a couple hundred LOC and running on top of other software is vulnerable in some way, but 100% secure do indeed exist.
Report to moderator   Logged

Offline lucid

  • #Underground
  • Titan
  • **
  • Posts: 2683
  • Cookies: 243
  • psychonaut
    • View Profile
Re: Bypass htmlspecialchars
« Reply #8 on: December 06, 2013, 01:42:55 am »
Perhaps you are right, so let me rephrase. Nothing stays 100% secure forever.
Report to moderator   Logged
"Hacking is at least as much about ideas as about computers and technology. We use our skills to open doors that should never have been shut. We open these doors not only for our own benefit but for the benefit of others, too." - Brian the Hacker

Quote
15:04  @Phage : I'm bored of Python
Pages: [1]