Bypassing ASP.NET "validaterequest" for stored XSS attack

Question

Lots of research has been done but I have not had any success. I have already checked the following links and many more.

https://infosecauditor.wordpress.com/2013/05/27/bypassing-asp-net-validaterequest-for-script-injection-attacks/

http://blog.diniscruz.com/2014/06/bypassing-aspnet-request-validation.html

Is there any way that how to bypass asp validation request for storing XSS attack.?

In above link, unicode characters are to be inserted and then popup on rendering time.

Is there any possibilities to execute script by unicode characters?

Is your requirement to bypass asp.net ValidateRequest functionality which is by default enabled for ASP.NET request.? — Habeeb
– Habeeb, Commented Apr 19, 2017 at 11:43
To encode your content to make it XSS safe, encode the string, like : HttpUtility.UrlEncode(inputString); — Habeeb
– Habeeb, Commented Apr 19, 2017 at 11:59

Habeeb · Accepted Answer · 2017-04-19 12:00:46Z

1

If your requirement is to bypass ASP.NET ValidateRequest functionality which is by default enabled for ASP.NET; then in the aspx page directive add the validateRequest attribute and set it to false. Se the code below:

<pages validateRequest="false" />

If your requirement is to make the input string XSS safe, encode the input string:

HttpUtility.UrlEncode(inputString);

edited Apr 19, 2017 at 12:00

answered Apr 19, 2017 at 11:46

Habeeb

8,0751 gold badge33 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Bypassing ASP.NET "validaterequest" for stored XSS attack

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related