Non-alphanumeric JavaScript

breun · **Posted:** Sat Aug 11, 2012 7:13 am

Quote:

What do you know about non-alphanumeric XSS?

The other day one of my friends asked me that question on IRC, pointing me to some articles on sla.ckers.org where they tried to create some scripts like alert(1) with non-alphanumeric characters.

As a security researcher and a penetration tester, he insisted that extending that concept to any javascript source would be really useful for bypassing IDSs, IPSs and WAFs. So challange accepted!

http://patriciopalladino.com/blog/2012/ ... cript.html

mikeshinn · **Posted:** Sat Aug 11, 2012 11:47 am

In the words of the character Wanda from "In Living Colour", "I got you!"

No need to worry, you are already protected against this if you are using either ASL or the real time rules (and your rules are kept up to date).

Rule 331029 in the advanced rules (MODSEC_11_ADV_RULES) detects this kind of obfuscation:

[modsecurity] [client 127.0.0.1] [domain localhost] [403] [/20120811/20120811-1137/20120811-113706-O4nFGsCoAfkAAEqZhSAAAAAA] [file "/etc/httpd/modsecurity.d/11_asl_adv_rules.conf"] [line "91"] [id "331029"] [rev "10"] [msg "Atomicorp.com WAF Rules: Possible Obfuscated Javascript injection."] Access denied with code 403 (phase 2).

Non-alphanumeric JavaScript

Who is online