XSS Filter Evasion Cheat Sheet

Future Snow

Contents 1 Introduction 2 Tests 2.1 XSS Locator 2.2 XSS locator 2 2.3 No Filter Evasion 2.4 Image XSS using the JavaScript directive 2.5 No quotes and no semicolon 2.6 Case insensitive XSS attack vector 2.7 HTML entities 2.8 Grave accent obfuscation 2.9 Malformed IMG tags 2.10 fromCharCode 2.11 UTF-8 Unicode encoding 2.12 Long UTF-8 Unicode encoding without semicolons 2.13 Hex encoding without semicolons 2.14 Embedded tab 2.15 Embedded Encoded tab 2.16 Embedded newline to break up XSS 2.17 Embedded carriage return to break up XSS 2.18 Null breaks up JavaScript directive 2.19 Spaces and meta chars before the JavaScript in images for XSS 2.20 Non-alpha-non-digit XSS

Address Resolution Protocol (ARP)

Future Snow

Hackers lie. Skillful hackers lie well. And well-rounded hackers can lie both to people and to machines.
Lying to people, known as "social engineering," involves tactics (detailed at length by convicted hacker Kevin Mitnick) such as posing as a company's employee so the company's real employees will blab secrets freely. Lying to machines involves lots of different techniques, and a commonly used one -- ARP Cache Poisoning -- is the focus of this article. ARP poisoning enables local hackers to cause general networking mayhem. Because it's mostly "incurable," every administrator should be aware of how this attack works.

ARP Refresher

In Foundations: What Are NIC, MAC, and ARP?, we explained that Address Resolution Protocol (ARP) is how network devices associate MAC addresses with IP Addresses so that devices on the local network can find each other. ARP is basically a form of networking roll call.
ARP, a very simple protocol, consists of merely four basic message types:

1. An ARP Request. Computer A asks the network, "Who has this IP address?"
2. An ARP Reply. Computer B tells Computer A, "I have that IP. My MAC address is [whatever it is]."
3. A Reverse ARP Request (RARP). Same concept as ARP Request, but Computer A asks, "Who has this MAC address?"
4. A RARP Reply. Computer B tells Computer A, "I have that MAC. My IP address is [whatever it is]"
   

SYN Flood Attack and SYN Cookies

SYN flood attacks can be used to take down servers by overwhelming their capacity for open connections.
Let’s suppose that there was a radio call-in show that you wanted to take off the air, and you know that they have a phone system capable of holding 7 callers on hold at the same time. So you go to the store and buy 7 cell phones. When the lines open up, you call the switchboard with all 7 phones simultaneously so that the show can’t accept any legitimate callers.
SYN floods work in a very similar manner.
When you contact a web server (or any other system), there is a standard “handshake” which takes place.

• First, you send a packet which contains a SYN or “Synchronize” flag. This signals the start of a conversation.
• If the server wants to start a conversation, it will issue a packet with an ACK or Acknowledgement flag.  This flag indicates that the server has opened a connection for your conversation. This connection will remain open until you close the connection or the connection times out.
• If the connection is refused, the server SHOULD send you a packet with a RST or Reset flag. But many systems and firewalls don’t reply at all to rejected connections for security reasons.
• Once the conversation has ended, you send a packet with a FIN or Finish flag to close the connection and free up these resources for others to use.