> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/xssy/html-filter-attribute-bypass-unintended-solution.md).

# HTML Filter - Attribute Bypass (unintended solution)

HTML Filter - Attribute Bypass - hard challenge with 4 solutions.

The challenge implies another intendend solution, nevertheless there is my unintended solution.

<figure><img src="/files/Vw7gnVP83uQ6ENiZHc5L" alt=""><figcaption></figcaption></figure>

The challenge provide simple input, let's test simple XSS payload for check behavior

<figure><img src="/files/VrmU3IZhUj5pI9Eoc0Rz" alt=""><figcaption></figcaption></figure>

With result:

<figure><img src="/files/VZJU1qmlkiRZLNsWAw3C" alt=""><figcaption></figcaption></figure>

As we can see basic XSS payload doesn't work, as name of html filter bypass, it was obviously. This sanitization reminded me of the dompurify sanitizer library.

Dompurify bypass has become quite popular, thanks to [Michał Bentkowski](https://research.securitum.com/authors/michal-bentkowski/) research of dompurify library bypass, for detailed information you can read his blog. But shortly i can say that bypass built on confusion using different namespaces, between HTML and SVG.

For example we can accord to simple mXSS payload for dompurify bypass with svg namespaces.

`<svg></p><style><a id="</style><img src=x onerror=alert()>">`

<figure><img src="/files/5WUYeTtHV7YPWteMnLY7" alt=""><figcaption></figcaption></figure>

If dompurify configuration allows to use rather harmless tag "svg" we can bypass sanitizer.

<figure><img src="/files/sNlHIFA8MRMwEKvH1xRj" alt=""><figcaption></figcaption></figure>

But svg is not allowed, thats mean previous payload will not work, as i said before bypass build on different parsing and confusion on it of namespaces,  as html and svg, but there is one more namespace as mathml.

For example:

`<math><style></math><form><style>`

<figure><img src="/files/VsHQw2xKB4lft6Hqj9Cb" alt=""><figcaption></figcaption></figure>

Have different  parsing behaviors based on this we can try payload:&#x20;

<figure><img src="/files/wtpWm8b7cF2tB1Ob6Fgj" alt=""><figcaption></figcaption></figure>

Dompurify does not see anything forbidden here, since in the html namespace - style has content only as text, but the key role here is played by `<form>` the tag, which, due to nesting, exhibits different behavior.

Dompurify works like this scheme:\
accept input -> parsing input -> serialize input

For example if we use:

`<i>test` - the parser will check it after that it will serialize it into `<i>test</i>`

Our payload: `<form><math><mtext></form><form><mglyph><style></math><img src onerror=alert()>`

Dompurify will return serialized html:

`<form><math><mtext><form><mglyph><style></math><img src onerror=alert()></style></mglyph></form></mtext></math></form>`

<figure><img src="/files/bKfg8EhPZyz0JwjnxULZ" alt=""><figcaption></figcaption></figure>

Great! let's check payload on the lab:

<figure><img src="/files/IO1lh3LEp1f3jLCA6ljb" alt=""><figcaption></figcaption></figure>