The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

406

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 406

---

case, then you need to test the filter to establish whether any bypasses exist.

The bypasses that are commonly found in real-world XSS filters include the

following:

■■

Many filters match specific tags, including the opening and closing

angle brackets. However, most browsers tolerate whitespace before the

closing bracket, which allows an easy bypass of the filter. For example: