XSS Filter Bypass

关于

This skill offers a structured framework for analyzing and evading HTML and JavaScript sanitization filters used in web applications. It moves beyond simple trial-and-error by providing guidance on identifying specific sanitization libraries, mapping filter behaviors, and exploiting parser differentials between servers and browsers. Ideal for security researchers and CTF participants, it details techniques involving SVG execution vectors, event handler variations, and URL-based execution while emphasizing a rigorous testing harness to ensure reliable and stable bypasses.

主要功能

• Systematic analysis of sanitization libraries like BeautifulSoup and DOMPurify
• Guidance on exploiting parser differentials and nested tag confusion
• Implementation strategies for alternative JavaScript execution vectors using SVG and MathML
• 16 GitHub stars
• Detailed mapping of blocked elements, attributes, and preserved HTML tags
• Best practices for building testing harnesses and multi-stage verification workflows

使用场景

• Security research to identify and document quirks in web application filters
• Analyzing and bypassing HTML sanitizers during authorized penetration testing
• Solving complex XSS challenges in Capture The Flag (CTF) competitions