Investigate Alternative XSS Detection

OWASP / SecurityShepherd

Web and mobile application security training platform

https://owasp.org/www-project-security-shepherd/

GNU General Public License v3.0

1.32k stars 447 forks source link

Investigate Alternative XSS Detection #297

Open githubname1 opened 7 years ago

githubname1 commented 7 years ago

Hello. In the above challenge '' Cross Site Scripting Two '' the following produces the XSS alert although it is not captured as correct by the application <marquee/onstart=alert('XSS')>. Am i doing something wrong or is it a bug? This is in Iceweasel version 38.5.0

etnoy commented 7 years ago

Same if you replace marquee with svg or something similar. Doesn't seem to be detected by security shepherd as a valid solution.

markdenihan commented 6 years ago

Shepherd has some gaps when it comes to detecting successful XSS attacks. This is one of them. We should investigate a different solution. Putting this on the backlog