The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

following attack using a UTF-16 encoded payload is effective against Internet

Explorer:

https://wahh-app.com/error.php?message=%FF%FE%3C%00%73%00%63%00%72%

00%69%00%70%00%74%00%3E%00%61%00%6C%00%65%00%72%00%74%00%28%00%64%00%

6F%00%63%00%75%00%6D%00%65%00%6E%00%74%00%2E%00%63%00%6F%00%6F%00%6B%

00%69%00%65%00%29%00%3C%00%2F%00%73%00%63%00%72%00%69%00%70%00%74%00%

3E%00

Because Internet Explorer ignores the nulls, it effectively auto-decodes your

payload, causing the original attack to execute.

Finding and Exploiting Stored XSS Vulnerabilities

The process of identifying stored XSS vulnerabilities overlaps substantially

with that described for reflected XSS, and includes submitting a unique string

as every parameter to every page. However, there are some important differ-

ences which you must keep in mind to maximize the number of vulnerabilities

identified.

HACK STEPS

■