CAPEC - Common Attack Pattern Enumeration and Classification (A Community of Knowledge Resource for Building Secure Software)
Home > CAPEC List > CAPEC-199: Cross-Site Scripting Using Alternate Syntax (Release 1.4)  

CAPEC-199: Cross-Site Scripting Using Alternate Syntax

 
Cross-Site Scripting Using Alternate Syntax
Attack Pattern ID: 199 (Standard Attack Pattern Completeness: Stub)Typical Severity: MediumStatus: Draft
+ Description

Summary

The attacker uses an alternate form of a key word or command that results in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible. The attack can result in the execution of otherwise prohibited functionality.

+ Attack Prerequisites

    The target web site must not adequately filter alternate syntax in web input.

+ Resources Required

The attacker must trick the victim into following a crafted link to a vulnerable server or view a web post where the dangerous commands are executed.

Page Last Updated: September 23, 2009