Sign in to follow this  
Followers 0


1 post in this topic

badWebMasters security advisory #012

Passing script/html-filter with special chars (multibrowser)

Discovery date: 2003-07-16

Update: 2003-07-31

Original advisory: (text/html)

Legal Notice:

Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!

You may distribute it unmodified.

You may not modify it and distribute it or distribute parts of it without giving credits and the URL where the original advisory can be found!

This document may change without notice.


ben moeckel (



When webbrowsers parse html they remove special chars, this behavior may be used by an malicious user to fool script/html-filters in webapplications.


badWebMasters showed in their advisory #011 how to pass the "Snitz Forums"-scriptfilter with the Tab-Char (09). After "Opera" and "Mozilla"-users noticed that the provided exploit didn't work on their system I decided to start some new testings, with an amazing result!

To detect what kind of special chars can be used in html- parameters I set up the following asp-page:



Response.BinaryWrite('<html><script>function a(o){alert(o)}</script>');

Response.BinaryWrite('<img src="java script:a(\'test\')" />');


uc = "%"+chk(i.toString(16));

Response.BinaryWrite('<img src="ja'+unescape(uc)+'vascript:a('+i+')" />\r\n');


function chk(sInp){if(sInp.length<2){

return String("0"+sInp)

}else{return sInp}}




The page has been viewed with Mozilla, Opera and Internet- Explorer, the alert-box poped up in this order:

Mozilla 1.3.1 (Win32): - (with restricions)

Opera 7.11 (Win32): 0, 9, 10, 13, 173

Internet Explorer 5.0: 13, 10, 9, 0

Webmasters may be carefull with char 173 (ADh) that can be used in Opera only.

Silly Internet Explorer: reversed order!?



Make sure control-chars are removed before badwords are!


[bWM #011]: Cross-Site-Scripting @ Snitz Forums



Thanks to "jelmer " for correcting my demo page!


Comments, suggestions, updates, anything else?



ben moeckel security research

copyright 2k1-3 by Benjamin Klimmek / Germany.


Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
Followers 0