What type of syntax is "% u00AB"?

Question

In this article, I warn about the XSS attack vector "%u00ABscript%u00BB" . I am wondering what type of syntax "%u00AB" is. In my brief tests on Chromium, it actually does not appear in the tag, and I believe that the syntax is used either by the SQL engine or by the server-side programming language. I do not store / display XSS, only based on the DOM. I don’t know, although maybe it looks like a ruby ​​or python or something else?

Also, does anyone know if there is a problem in other browsers? I tested only Chromium, but maybe other versions and browsers behave differently and therefore are vulnerable.

Answer 1

This kind of percent encoding mechanism, known as non-standard Unicode or %u encoding , was rejected in 2004.

In short, you should know all the possible combinations of the character "<" . The best starting point is the OWASP XSS Filter Evasion Cheat Sheet .

Answer 2

The syntax %uhhhh is a non-standard version of the well-known encoding, in which you can specify a Unicode character directly by its code point, and not by its encoded code point, as some languages ​​support \uhhhh . This syntax is supported by the JavaScripts unescape function, as well as the Microsfts IIS web server.

But that is probably not the reason, since %u00AB will display on. « The reason for this is rather a kind of transliteration as iconv icons :

 iconv('UTF-8', 'ASCII//TRANSLIT', '«') === '<<' iconv('UTF-8', 'KOI8-R//TRANSLIT', '«') === '<<' 

And according to Jeremy Grossmans on the "Results" blog, "Unicode left / right," indicating "End quote with double angel" , citing this vulnerability, the number of vulnerable applications summarize:

Arian promised to return to 3APA3A after scanning several hundred production sites using the WhiteHat Sentinel . The huge advantage of the R & D platform. Two years later, there is data to share. We were busy, but hey, better late, never? :) As it turned out, 3APA3A was right! Arian discovered a small number of web applications that are vulnerable to coding technology, and they add up if the sample pool is large enough. Samples from 300 to approximately 1000 sites.