Internet Explorer whitespace-as-comment hack to bypass input filters
11 Jan 2007
When testing for XSS (cross-site scripting) issues, you often need to bypass filters and perform different sorts of encodings and other trickery. To be a good tester you also need to know how the browsers you're concerned with behave differently. In Internet Explorer 6.0 there's a behavior that's allowed seemingly impassible input validation filters to be bypassed. Note that the issue is not the browser's fault, it's the fault of an improperly designed input validation mechanism on the server. Okay to illustrate the point.
You're testing a web app that has an input field. Some script tags are allowed but <img src="something"> is not. By replacing the whitespace with a comment, your code is accepted. When returned to the browser, IE 6.x, the comment is interpreted as whitespace and the code is executed fine. Test it out:
This trick can be useful for more than just bypassing filters...
You're testing a web app that has an input field. Some script tags are allowed but <img src="something"> is not. By replacing the whitespace with a comment, your code is accepted. When returned to the browser, IE 6.x, the comment is interpreted as whitespace and the code is executed fine. Test it out:
//Start HTML
<html>
<body>
<img/*comment*/src="javascript:alert('img tag')">
</body>
</html>
//End HTMLThis trick can be useful for more than just bypassing filters...