Re:XSS (Cross Site Scripting) Cheat Sheet
by jerf on Monday February 13, 2012 @08:57PM
(#3588277)
In what way are you saying it's out of date? The vast, vast bulk of those will work today just fine; very few of them are actually based on browser bugs. Most of them are really about getting valid HTML past dumb filters.
Re:XSS (Cross Site Scripting) Cheat Sheet
by aj-code on Tuesday February 14, 2012 @05:25AM
(#3589435)
One of the most useful features of that site used to be that you could tell at a glance which browsers the XSS payload would work on, and which it wouldn't. It hasn't been updated for modern browsers so now you have to test each browser yourself.
A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?
Re:XSS (Cross Site Scripting) Cheat Sheet
by jwatzman on Monday February 13, 2012 @10:54PM
(#3588532)
Unfortunately what we nowadays call "regular expressions" aren't the regular expressions from math class -- they can match against much more than regular languages. I believe PCRE, i.e., the "regular expression" language for most regex libraries, is Turing-complete though I can't find a citation for that right now.
Re:XSS (Cross Site Scripting) Cheat Sheet
by Kiro on Monday February 13, 2012 @07:47PM
(#3588075)
I remember using this a lot when making a site back in the days where users could change stuff using HTML/CSS. I had to gradually add more regex filters to combat trolls who managed to insert nasty JS. It was great fun and I don't think the trolls realised that they were actually doing me a favor all along.
It is, however, a nice illustration of why your sanitisation regex probably isn't going to work as well as you'd like.
(Additional notes: http://stackoverflow.com/questions/1732348/regex-match-open-... )
A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?
HTML is not a regular language.
Programming languages are not a regular language.
Generally if there are opening and closing statetements -> it is not a regular language.
Something that isn't a regular language, cannot be handled by regex.