The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

408

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 408

---

T I P

In some cases, you may succeed in being able to execute some JavaScript

but face restrictions on the commands and keywords that you can employ in

your code. In this situation, the application’s filters can often be bypassed by

building and executing statements dynamically. For example, if the application

blocks any user-supplied data containing the expression 

document.cookie

,

then this can be trivially bypassed using

var a = “alert(doc” + “ument.coo” + “kie)“; eval(a);

or even

var a = “alert(“ + String.fromCharCode(100,111,99,117,109,101,110,

116,46,99,111,111,107,105,101) + “)“; eval(a);