Bypassing XSS filters by enumerating permitted tags and attributes

Reflected cross-site scripting (XSS) arises when an application receives data in an HTTP request, then includes that data in its response in an unsafe way.

Applications use a range of processing and input validation methods to protect against common XSS payloads. You can use Burp Intruder to enumerate tags and attributes that are permitted by the application. This enables you to craft an XSS payload that will be executed by the application.

Before you start

Identify a request / response pair with reflected input. For more information, see Identifying reflected input.

Steps

You can follow the processes below using the lab Reflected XSS into HTML context with nothing encoded.

1. In Proxy > HTTP history, right-click the request with a reflected input that you want to investigate. Select Send to Intruder.

2. Identify whether any tags are permitted:

   1. In Intruder, replace the value of the input with: <>.

   2. Click inside the angle brackets, then click Add § twice to add a payload position.

      
   3. Go to the Payloads tab. Under Payload settings [simple list] add a list of tags that you want to test. For example, use the tags in the XSS cheat sheet.
   4. Click Start attack. The attack starts running in a new dialog. Intruder sends a request for each tag on the list.
   5. When the attack is finished, look for any responses with a 200 status code. This indicates that the tag is permitted. If a tag is filtered out, it has a 400 status code instead.

3. Identify whether any attributes are permitted:

   1. In Intruder > Positions, update the payload position. Add a tag that you enumerated in the previous step, then add payload markers to test different attributes.

      
   2. Go to Intruder > Payloads. Click Clear to remove the list of tags that you tested in the previous step.
   3. Under Payload settings [Simple list] add a list of attributes that you want to test. For example, use the attributes in the XSS cheat sheet.
   4. Click Start attack. The attack starts running in a new dialog. Intruder sends a request for each attribute on the list.
   5. When the attack is finished, look for any responses with a 200 status code. This indicates that an attribute is permitted.

You can use the permitted tags and attributes that you identified to construct an attack string. For more information, see Testing for reflected XSS manually.