One of the fundamental skills needed for successful XSS is to understand filter evasion. This is because filters are often used by Web developers to prevent a would be attacker from injecting dangerous characters into a server side application. However, by paying attention to the rendered HTML, it is often possible to subvert such protections. This chapter will focus on filter evasion techniques, which is where most of the interesting aspects of XSS lay.

First, let's look at a traditional XSS example where the attacker is injecting a probe to determine if the site is vulnerable:

When this example is injected into an input box or a URL parameter, it will either fire or it will fail. If the injection fails, it doesn't mean the site is secure, it just means you need to look deeper. The first step is to view source on the Web page and see if you can find the injected string in the HTML. There are several places you may find it completely intact, yet hidden from the casual observer. The first is within an input parameter:

In this example we could alter our input to include two characters that allow the injected code to jump out of the single quotes:

'>

Now our code renders because we have ended the input encapsulation and HTML tag before our vector, which allows it to fire as shown in Figure 3.37.

Figure 3.37: XSS Exploit In Action

However, in this case, the extraneous single...