Rhainfosec XSS Challenge 1 - Writeup

Update - The challenge is still up on hack.me - https://hack.me/101575/bypass-blacklist-based-waf-challenge.html

On 7th January 2014, we announced an XSS challenge for the whole infosec community, the challenge was based upon blacklist based protection and the task was to bypass the blacklist based protection and to execute the javascript. Based upon unique IP addresses we had 1740 participants and more then 80k unique vectors were recorded into our log file which is a tremendous turn out, the size of the log file was around 4.4 mb, which is pretty huge. Out of 1740 participants only 17 were able to solve it, which is less then 1% (0.97 to be exact).

Challenge Setup

To make your lives a bit harder, we induced certain amount of difficulties. Here is an overview of what we had done:

• We blacklisted alert, prompt, confirm, document.write functions which are most commonly used to execute javascript. 
• We blacklisted open & closed parenthesis, which is what most of the XSS vectors require. 
• We blacklisted most commonly used event handlers such as onclick, onfocus etc
• We blacklisted the closing bracket ">". 
• We blacklisted most of the attributes used to execute javascript such as src, formaction, action etc. 
• We blacklisted "+" sign, which otherwise would had been used to concatenate javascript strings, however we did leave a room for it. (More on it later). 
• The winners for the challenge would be decided on the basis of the shortest vector by length. 

Hints

The two of most important hints we gave was as follows:

• Look at alternative javascript execution possibilities. 
• The solution for the challenge was already given inside my "XSS filter evasion cheat sheet", however you would need tweak the payload. (Obviously, there was not point to the challenge, if the solution was already there).

Partial Bypass - Solution

As it was mentioned in one of the hints that you would need to look at alternative javascript execution possibilities. Almost all attributes were being filtered except the "code" and "data" attribute. The "code" attribute can be used along with the "embed" element and the "data" attribute can be object element to execute the javascript. 

Vector #1 

Several instances of the "Object" element were being filtered, however it wasn't difficult for some one to figure it out. The "data" attribute was being filtered out too, however case-sensitive based escaping was not being done. Therefore the final vector would be: