{"id":413,"date":"2012-03-01T13:24:26","date_gmt":"2012-03-01T12:24:26","guid":{"rendered":"https:\/\/www.phillips321.co.uk\/?p=413"},"modified":"2016-06-22T14:20:32","modified_gmt":"2016-06-22T13:20:32","slug":"xss-browser-filters-disabling-it-for-app-testing","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/03\/01\/xss-browser-filters-disabling-it-for-app-testing\/","title":{"rendered":"XSS browser filters, disabling it for app testing…"},"content":{"rendered":"

So you’ve got some XSS that you want to test but the browser you’ve been using for your app testing is protecting against the use of javascript in the address URL. The following URL:<\/p>\n

1
<\/div><\/td>
http:\/\/<\/span>example.com\/<\/span>index.asp?val<\/span>=<<\/span>script><\/span>alert(<\/span>1<\/span>)<\/span><\/<\/span>script><\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Would end up getting sent to the server as:<\/p>\n

1
<\/div><\/td>
GET \/<\/span>index.asp?val<\/span>=%<\/span>3Cscript%<\/span>3Ealert(<\/span>1<\/span>)<\/span>%<\/span>3C\/<\/span>script%<\/span>3E HTTP\/<\/span>1.1<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

In order to prevent this so we can test XSS flaws within applications we need to turn off the javascript filter in the client browser.<\/p>\n

There are a number of browsers and here’s the ways to do it in each of them.<\/p>\n

IE<\/strong>
\nClick Tools–>Internet Options and then navigate to the Security Tab.
\n\"\"<\/a>\"\"<\/a>
\nNow click Custom level and scroll towards the bottom where you will find that Enable XSS filter<\/em> is currently on Enable. Set it to diabled. Click OK.
\n\"\"<\/a>
\nClick Yes to accept the warning followed by Apply and then finnaly OK.
\n\"\"<\/a><\/p>\n

Firefox<\/strong>
\nFirefox configuration settings can be found by going to about:config<\/em> in the URL address bar.
\n\"\"<\/a>
\nNow in the serach field type urlbar.filter<\/em> and you’ll see that the value browser.urlbar.filter.javascript<\/em> is set to true.\"\"<\/a>Double click this value and it’s change the bollena to false. Your all set.
\n\"\"<\/a><\/p>\n

Additionally for firefox:
\nsecurity.mixed_content.block_active_content
\nsecurity.mixed_content.block_display_content
\nnetwork.security.ports.banned.override
\nsecurity.disable_button.openCertManager
\nbrowser.urlbar.filter.javascript
\nurlbar.filter
\nbrowser.newtabpage.enabled<\/p>\n","protected":false},"excerpt":{"rendered":"

So you’ve got some XSS that you want to test but the browser you’ve been using for your app testing is protecting against the use of javascript in the address URL. The following URL: 1http:\/\/example.com\/index.asp?val=<script>alert(1)<\/script> Would end up getting sent to the server as: 1GET \/index.asp?val=%3Cscript%3Ealert(1)%3C\/script%3E HTTP\/1.1 In order to prevent this so we can […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[157,158,155,154,156,150,152,153,151],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/413"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=413"}],"version-history":[{"count":17,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/413\/revisions"}],"predecessor-version":[{"id":1307,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/413\/revisions\/1307"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}