Security Researcher & Developer | Somdev Sangwan

Somdev Sangwan Hacker & Maker Est. 2017 Has brain Has ~~taste~~ hello[at]somdev.in ~~Available for work~~ experience on hold, for now experience obsession screentime

GitHub X Instagram LinkedIn Gmail

papers Bypassing XSS Detection Mechanisms Somdev Sangwan Abstract This paper proposes a well-defined methodology to bypass Cross Site Scripting (XSS) security mechanisms by making assumptions about the rules being used to detect malicious strings by sending probes and crafting payloads based on the assumptions. The proposed methodology consists of three phases: determining payload structure, probing and obfuscation. Determining various payload structures for a given context provides a precise idea of the optimal testing approach. The next phase, probing, involves testing various strings against the target's security mechanisms. The target's responses are analyzed in order to make assumptions based on the analysis. Finally, obfuscation and other tweaks are made to the payload if required. To the Reader The author assumes that the reader has at least basic level knowledge of Cross Site Scripting, Hypertext Markup Language (HTML) and JavaScript. {string} is used throughout the paper to represent components of a payload scheme. {?string} represents an optional component. The word primary character refers to a character which must be included in a payload. It is advised to URL encode URL unsafe characters such as + and & before using them in payloads. While probing, a harmless string should be used instead of {javascript}.