Why does Content-Type and Extension matter?
Applications come in many different shapes and sizes and XSS can occur all over the place. It's easy to assume that just because an application returns you a response with unfiltered/unencoded output you've found an exploitable XSS issue but this is often not the case. Browsers render content based on a number of factors including content-type returned by the server, page content and page extension, without the correct combination XSS won't be possible.
To try and get a definitive answer of what works and what doesn't I thought I'd do some testing. I used multiple file types each containing their legitimate content however I also embedded a JavaScript alert payload in each. Each test case was ran against Chrome 43, IE 11 and Firefox 39. In the tables below "yes" means the payload rendered and "no" means it didn't.
In the first test I forced the server to return the correct extension and content-type for each test page.
Content-Type
|
Extension | Chrome | IE | Firefox |
---|---|---|---|---|
None | None | yes | yes | yes |
text/plain | txt | no | no | no |
text/html | html | yes | yes | yes |
application/javascript | js | no | no | no |
application/json | json | no | no | no |
application/xml | xml | yes | yes | yes |
text/css | css | no | no | no |
image/jpeg | jpeg | no | no | no |
Following best practice modern browsers appeared to be pretty secure. The one exception appears to be XML, it seems odd that the browser would allow the rendering of JavaScript in an XML file.
Test #2 - Modifying Extension
In the second test I made the server return the correct content-type but forced a .html extension.
Content-Type
|
Extension | Chrome | IE | Firefox |
---|---|---|---|---|
None | html | yes | yes | yes |
text/plain | html | no | no | no |
text/html | html | yes | yes | yes |
application/javascript | html | no | yes | no |
application/json | html | no | no | no |
application/xml | html | yes | yes | yes |
text/css | html | no | no | no |
image/jpeg | html | no | no | no |
This test seemed to show that browsers will prioritize the use of the content-type over the extension.
Test #3 - Using a text/html Content-Type
In the third test I used the correct extension for each file but made the server return a text/html content-type.
Content-Type
|
Extension | Chrome | IE | Firefox |
---|---|---|---|---|
text/html | None | yes | yes | yes |
text/html | txt | yes | yes | yes |
text/html | html | yes | yes | yes |
text/html | js | yes | yes | yes |
text/html | json | yes | yes | yes |
text/html | xml | yes | yes | yes |
text/html | css | yes | yes | yes |
text/html | jpeg | yes | no | yes |
It looks like browsers rely heavily on the content-type returned by the server. It doesn't matter about the extension or contents of the file, the browser will blindly follow the content-type returned.
Test #4 - Using a text/plain Content-Type
Next I used the correct extension for each file but made the server return a text/plain content-type.
Content-Type
|
Extension | Chrome | IE | Firefox |
---|---|---|---|---|
text/plain | txt | no | no | no |
text/plain | html | no | no | no |
text/plain | js | no | no | no |
text/plain | json | no | no | no |
text/plain | xml | no | no | no |
text/plain | css | no | no | no |
text/plain | jpeg | no | no | no |
When using a content-type of text/plain none of the payloads executed. I can't remember for sure, but I believe in the past text/plain used to allow XSS? Looks like this is no longer possible.
Test #5 - MIME sniffing
In this last test case I accessed a page that had no extension and received no content-type header from the server. This should have caused the browser to fall back on mime sniffing to render the page.
MIME
| Content-Type | Extension | Chrome | IE | Firefox |
---|---|---|---|---|---|
text/plain | None | None | no | yes | no |
text/html | None | None | yes | yes | yes |
application/javascript | None | None | yes | yes | yes |
application/json | None | None | no | yes | no |
application/xml | None | None | no | yes | no |
text/css | None | None | no | yes | no |
image/jpeg | None | None | no | no | no |
Both Chrome and Firefox refused to render pages that contained additional non-html content. IE however didn't seem to care what the page content was, if it contained HTML it rendered!
Conclusion
Performing application testing on a regular basis I find content-type and extension XSS issues arise quite a lot. This test showed that modern browsers are relatively secure as long as the correct content-type is returned. All browsers also seemed to implement the same analysis techniques aside from IE which seemed slightly more permissive.
Hopefully you guys have found this post useful, if anyone has any suggestions for bypasses to achieve XSS in any of the above, or if I've listed any findings incorrectly (quite possible) drop me a message below :)
Pwndizzle out.
Thanks, very useful information!
ReplyDeletePwndizzle: Xss, Extensions And Content-Types >>>>> Download Now
Delete>>>>> Download Full
Pwndizzle: Xss, Extensions And Content-Types >>>>> Download LINK
>>>>> Download Now
Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Full
>>>>> Download LINK o3
it was useful for me
ReplyDeleteBy the way, this information will help you to write an abstract for a dissertation. It's important to know
ReplyDeleteAwesome! We’re looking forward your blog
ReplyDeleteI have some suggestions. Here is a blog - Photo editing & photography tips.
This may help you to find something useful
This comment has been removed by the author.
ReplyDeleteIn this post I'll look at which Content-Types and Extensions can actually be used for XSS in modern browsers.
ReplyDeleteDissertation VS Thesis
A paper that determines or describes a specific term is called a definition essay. At first, it seems that there is nothing easier than creating such an academic work. However, you can always buy definition essay.
ReplyDeleteThanks for sharing this nice post. I am surprised to see your work. You shared an informative post. I appreciate you for your good work. Carry on your journey of hard work. Get help from dissertation proposal writing services, a distinctive writing company UK
ReplyDeleteWhat a nice blog! I have enjoyed reading through the article although I landed on this site while I was looking for research paper writing, which to which speech time calculator concluded. I will be visiting this site occasionally to read more interesting and intriguing articles. I hope the writer will continually keep us updated with new information.
ReplyDeleteVery nice blog,
ReplyDeleteThanks for sharing grate information.
From: Laptop Technicians
Looking for academic assistance? click this link now It is a place where you’ll get great papers for a reasonable price.
ReplyDeleteSometimes it's a great idea to check some interesting blogs. As well, people can help each other. For example, I prepare some samples of interview paper. It can be a beneficial item for students.
ReplyDeleteIf you're looking to lose fat then you certainly need to try this totally brand new custom keto meal plan.
ReplyDeleteTo produce this keto diet service, licenced nutritionists, personal trainers, and cooks joined together to provide keto meal plans that are useful, convenient, cost-efficient, and enjoyable.
From their first launch in early 2019, hundreds of individuals have already remodeled their body and well-being with the benefits a good keto meal plan can offer.
Speaking of benefits; in this link, you'll discover 8 scientifically-tested ones offered by the keto meal plan.
best boho dresses and jewelry at amazing price @bohemian land
ReplyDeletefeel
pep up look of your car by these super elegant car accessories @ auto x tools
ReplyDeletegood
Hello! I know that more and more people look for a writing help. Some of them can find such help at the essay wring service. There people can find such information what are the three theoretical approaches to ethics
ReplyDeleteNice post done by author.
ReplyDeleteFix HP Envy 7855 Printer Offline Problem
How to Update Garmin gps Maps
Quickbooks is the advanced accounting software to track and manage business data conveniently. The software is enriched with multiple accounting features.
ReplyDeleteQuickbooks data Transfer
This comment has been removed by the author.
ReplyDeleteGood afternoon! Liked this post. Wanna read similar articles? Visit a service https://essays-writer.net/health-care-research-topics-for-argumentative-essay-best-ideas.html. There are plenty of enlightening articles.
ReplyDeletecanon 5b00 error
ReplyDelete5b00 error
canon error code 5b00
5b00 error restoring program for canon printers
canon g2000 5b00 error
how to fix g2000 blinking 7 times the ink absorber full error 5b00
canon g2000 error 5b00
maintenance automation in usa
ReplyDeleteemail and task management in usa
project management automation in usa
b2b web development in usa
retail process automation in usa
Thanks for Sharing.
ReplyDeletePower BI Corporate Training in Chennai
BI and Data Analytics Training
Power BI Corporate Training in Pune
Power BI Corporate Training
Advanced Excel Training in Chennai
A failure to compose a decent article review or any other piece of writing can often result due to the lack of necessary skills, time, experience, as well as knowledgeable article review writing service is there to help you.
ReplyDeleteCustom application development solutions is meant for designing a software specially for an organization. The advantage of custom application over standard applications is that standard applications were designed with a general set of features to be used by different verticals and organization.
ReplyDeleteBest Hospital management system. It including Hospital billing, Hospital appointments, Hospital scheduling, Hospital regulatory compliance and Hospital financial auditing within healthcare management software by Accurate Infosoft
ReplyDeleteLeather fashion jacket never runs out of style and if you’re looking for best articles regarding Harley Davidson leather Jackets, you’re just at the right place.
ReplyDeleteJnJ is a registered firm that deals with all kinds of leather jackets, including motorbike racing suits, motorbike leather jackets and leather vests, leather gloves, for both men and women.
It is shown in the Gurgaon and Noida dlf cyber cities list of manufacturing companies in Noida where they have numerous career growth opportunities. The large scale and availability of many amenities have enabled these cities to be a magnet for companies that want to build their reputations and make a living.
ReplyDeleteHey admin, I am second time visits your website articles and trust me its really so beneficial for all readers. I definitely enjoying every little bit of it. It is a really superb website for new readers, I want to thank you so much for your efforts. Good job! You guys do a very best blogs. Essay Help - statistics homework help - college homework help
ReplyDeleteThis is nice blog if you want to take online exam services now click here-:
ReplyDeletetake my online test for me
write my assignment
essay helper
do my assignment online
Students have multiple types of problems related to college assignments. So My Assignment Experts
ReplyDeletehave a well-educated expert for writing assignments. If you have any obstacles with writing assignments. then Don’t worry because My Assignment Experts provide the most reliable online assignment help and free plagiarism assignment.
Thanks for such informative post. I have written an article about how to write synopsis for project Please visit us to read this.
ReplyDeleteIf you are planning to get human based language translation in Singapore for academic assignment then you should consult Singapore translators,Our experts are avail 24*7 to deliver you well precise academic translation into desired languages.
ReplyDeleteWrite down all the important points or information that you find useful. Also, even after taking notes, if you find any topic or concept difficult to understand, then you can go for assignment help online as well for clarifying your concepts.
ReplyDeleteAssignment help online
assignment help online
take my online class for me
management assignment help
marketing assignment help
Your blog is very informative and nice to read such high-quality content. There is lots of information on your blog, thank you for sharing with us. I want to share some important information with you regarding UNIDEL post utme question
ReplyDeleteI’m extremely impressed with your article contents and also with the layout on your blog. Thanks for sharing your useful thought.
ReplyDeleteIObit Driver Booster Pro 9
IObit Driver Booster Pro Key
Driver Booster Pro 9
IObit Driver Booster Pro
IObit Driver Booster Pro
Driver Booster Pro 9 Key
Great Assignment Help offers online dissertation help services to the students around the globe. We provide reasonable assistance to the students in dissertation help online writing without missing the deadline.
ReplyDeleteVery informative. Thanks for delivering children’s books agency
ReplyDeleteThis post is very good I am very happy to see this post. Thanks for sharing such a great article. Keep up the work... your site is great, and it's helping us a lot.
ReplyDeleteIt really Great Article, Please Upload Daily Posts.
These Are My Aps Please Check Out.
Video Player App 😍
" Ad-Free Video Player"
Good Morning Images
NICE BLOG
ReplyDeleteInternship providing companies in chennai | Where to do internship | internship opportunities in Chennai | internship offer letter | What internship should i do | How internship works | how many internships should i do ? | internship and inplant training difference | internship guidelines for students | why internship is necessary
Hi...
ReplyDeleteThis topic lists most common MIME types, with corresponding document types, ordered by their common extensions.
You are also read more Instant Loan Online
esign zoned is a web design company that provides logo design, graphic design, Website design. We offer fully optimized, up-to-date designs of the website at an affordable price.
ReplyDeleteSucceed! It has the potential to be one of the most useful and valuable articles ever written. Excellent information! I'm also a specialist in this field, therefore I fully appreciate your efforts. Thank you so much for your assistance, and believe me when I say that you are a master in this sector and that you can achieve much more goals with this. Best of luck in your search for new information.
ReplyDeleteinternational relations assignment help
Great articleessay typer Ottawa
ReplyDeleteFantastic and useful information.
ReplyDeleteI'm glad to hear you're doing well.
Thanks for providing this useful information! Please keep us posted.
Here you go. Thanks for sharing.
wondershare pdfelement crack key
360 total security crack
r drive image crack
4k video downloader crack
My first choice seems like a useful program at first glance.
ReplyDeleteIn short, depending on the location of the user, loading and storing your information is supported.
I really appreciate your smart writing, like the design of your blog.
Problems with payment or did you pick it up yourself?
Either way, it's best to keep a record.
nero burning rom 2021 crack
bzzt image editor pro crack
anydvd hd crack
mailbird pro crack
It's fascinating to visit this website and read all of your friends' opinions.
ReplyDeleteWhile I am interested in the subject of this piece of writing, I am also excited to
acquire familiarity
magix vegas movie studio crack
graphics converter pro crack
express vpn crack
windows 7 ultimate crack
I bet I won't be so disappointed with a blog post in the future that I won't read it.
ReplyDeleteSo the bottom line is that I'm really looking forward to this, but I hope you can say something interesting.
In case you weren't paying attention, I just heard you complaining about things that could have been fixed if you weren't so desperate.
outbyte driver updater license key
driver fix license key
fabfilter pro q key
ReplyDeleteIf you want our writer to assist you in achieving excellent grades in , we can make that wish a reality. It's time to excel in Psychology Homework Help Online your academic career by utilizing our expert educational services, which guarantee 100 percent original documents that are unique, interesting, and error-free.
I like your all post. You Have Done really good Work On This Site. Thank you For The Information You provided. It helps Ma a Lot.
ReplyDeleteit Is Very Informative Thanks For Sharing. I have also Paid This sharing. I am ImPressed For With your Post Because This post is very beneficial for me and provides new knowledge to me. This is a cleverly written article. Good work with the hard work you have done I appreciate your work thanks for sharing it. It Is a very Wounder Full Post.
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ccleaner professional crack
ReplyDeleteYou have a great site, but I wanted to know if you know.
Any community forum dedicated to these topics.
What was discussed in this article? I really want to be a part of it.
A society in which I can obtain information from others with knowledge and interest.
Let us know if you have any suggestions. I appreciate this!
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
ransomware defender crack
Our Learn to Swim kids program gives uninterrupted learning for your children all year round. Baby Swimming Lessons Cranbourne are accompanied 49 weeks of the year to support for consistent training and to present students with the possibility to grow through levels at a quicker rate. The Star Swim Schools provides you peace of mind that your kid will receive a high-quality swimming education.
ReplyDeleteWomen's Private Swimming Lessons
I would like to thank you for the effort you put into writing this page.
ReplyDeleteI also hope that you will be able to check the same high-quality content later.
Really, your creative writing skills have inspired me to create my own blog now😉
anno1800 pc game with crack
anno1800 crack
anno1800 crack
anno1800 crack
Team Designs is the best 3D architectural rendering services provider in Australia. We offer the latest 3d designs according to customer expectations and requirements. We provide a large variety of 3d rendering, interior designs and 3d floor plans for homes, residential apartments, office and industrial designs, etc.3d rendering
ReplyDeleteIt was very easy to find my way around and very user friendly Good job to your designer and dev of your site. I hope your rate was doing well.
ReplyDelete토토사이트
온라인경마
Hi....
ReplyDeleteThe file extension and MIME type can describe an image file, but the file content can be text/javascript or text/html resulting in script execution.
If any issue then contact the margin trading meaning
Always delicious food, easy to order take out indisk mad and very friendly and polite delivery man :)
ReplyDeleteWholesale T-shirts, cheap polo shirts & other high quality blank hoodies wholesale blank apparel Blank T Shirts we continually strive to bring you the best selection in wholesale blank t-shirts.
I'm ecstatic to have come across this article. The author has a very creative mind; life is about creating yourself rather than finding yourself. Please pay a visit to my page because my post contains important information. https://cracksir.com/batchphoto-crack/
ReplyDeleteThe delightful anxieties may very well have gone away, but I still recall the joy I felt torturing my pals when the deadline loomed and they hadn't accomplished their responsibilities.https://crackguru.net/download-accelerator-plus-crack/
ReplyDeletePwndizzle: Xss, Extensions And Content-Types >>>>> Download Now
ReplyDelete>>>>> Download Full
Pwndizzle: Xss, Extensions And Content-Types >>>>> Download LINK
>>>>> Download Now
Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Full
>>>>> Download LINK IT
Thank you so much for all of your efforts! As long as you keep going, you'll receive what you deserve.
ReplyDeletehttps://keygenhere.com/articulate-storyline-3-crack/
This comment has been removed by the author.
ReplyDeleteDear author, This is very Nice Article and it's very helping us this post is unique and interesting paid guest posting. Thank you for sharing this awesome information.
ReplyDeleteFantastic blog I have never ever read this type of amazing information. Golf Hoodie
ReplyDeleteThe great website and information shared are also very appreciable. Johanna Constantine Coat
ReplyDeleteGreetings to everyone i am olivia, Have you ever heard people saying that Physics is one of the most difficult subject? well i thought that same untill i found new assignment help australia, i am really satisfied with their Physics Assignment Help services which they provided me and because of them i archieved A+ grades in my exams, If you are looking for the best assignment help services you should definitely go with them !!!
ReplyDeleteThanks for sharing, such a nice Blog.I like it.
ReplyDeletevisite my website
forum syair sdy
syair sdy
This comment has been removed by the author.
ReplyDeleteDissertations are very hard to write, and you might wonder way. This is actually a common concern with college students, many of whom go to extreme lengths just to get a passing grade in a subject. You can buy it here https://topdissertations.com/dissertation-for-sale/
ReplyDeleteGet the best Tort Law Assignment Help at australianlawassignmenthelp.com. Our team of expert writers and editors offers tailored solutions to meet your specific needs and requirements. Trust us for top-quality work that exceeds your expectations and leads to academic success. Rely on us for accurate and effective support, ensuring that you receive the best possible outcome.
ReplyDeleteThanks for sharing this valuable information with us.
ReplyDeleteGothic EMO Pants
You have to follow some easy steps for hiring experts through GotoAssignmentHelp’s help with dissertation service. First, share your requirements and every detail about your assignments. Then make payment and you will get your complete solution paper. Before delivering, the assignments are checked many times by the proofreaders. They check spelling mistakes, grammatical errors, sentence formation, paragraph formation, etc. You can make payments via PayPal, VISA, MasterCard, Maestro, American Express, DISCOVER, etc. there are no hidden charges here. You can visit the official website of GotoAssignmentHelp if you want more information about this service.
ReplyDeleteRead more – Transition Words for Essay
I read your Blogs and I also read Blog on this topic in several articles from other sources. I got a lot of information from your content. I am also a web blogger plz visit my site very impressive Recipe For Fried Green Tomatoes
ReplyDelete
ReplyDeleteKinemaster Pro Crack Full Version
Kinemaster Pro Crack has user-friendly design ensures fluid publishing experiences by making it simple to browse throughout program’s capabilities.
QualityEssay organized this project several years ago under the slogan “Be successful.” Now, users have the opportunity to work in any desired browser at a higher speed, even on weak systems.
ReplyDeleteJoin the ranks of distinguished academic writers with our letter of recommendation writing service featuring thorough plagiarism checks as a cornerstone. From honing your research skills to mastering citation formats, our curriculum is tailored to meet the demands of scholarly writing. With our guidance, you'll navigate the complexities of academic integrity and emerge as a proficient writer with a commitment to originality. Enroll today and embark on a journey towards academic excellence.
ReplyDeleteGlobal assignment expert is the leading assignment writer near you. We offer students, assignment solutions according to their requirements. Global assignment help has a team of academic writers with more than 5 years of experience. Our team will help you with all your problems and achieve good academic grades. Expert assignment is reachable for all subjects and delivers their services worldwide. So connect with us and give us a chance to serve you better. Visit our official website for more queries.
ReplyDeleteWith waterproof binoculars, you can explore the great outdoors without worrying about water damage. These binoculars are built with a durable and sealed construction that keeps moisture out, allowing you to confidently use them in rainy or humid environments.
ReplyDeleteWhether you're an avid birdwatcher, a nature photographer, or simply enjoy observing wildlife, waterproof binoculars will enhance your experience by providing you with a clear and fog-free view, even in challenging weather conditions. So, don't let a little rain or water stop you from enjoying the beauty of nature – invest in a pair of Waterproof Binoculars and embark on your next adventure with peace of mind.
Demonstrate your desire to build your career in the direction of buy pre-written articles aimed at professional growth in a certain field, which is fundamental to the future necessary to achieve certain goals. This is an opportunity to look at yourself through the eyes of the world, to reassess your opportunities and the challenges facing us as a global community.
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteGet PhD dissertation
ReplyDeleteWriting assistance by the PH. D expert writers of Instant assignment assistance. We offer top quality dissertation writing service to the students on the numerous PhD dissertation topic
Java Assignment Help is essential for students struggling with complex coding tasks. It provides clear guidance, helping them understand concepts better, enhance programming skills, and achieve academic success. A reliable resource for mastering Java effectively.
ReplyDeleteDuring regular application testing, content-type and extension XSS issues frequently surface, highlighting the importance of thorough security checks. For top-notch service beyond tech, check out the fit out companies in Dubai.
ReplyDeleteAn excellent and comprehensive exploration of XSS, extensions, and content-types—your detailed analysis really sheds light on these crucial security concepts!
ReplyDeleteKuari Pass Trek in Uttarakhand
"XSS vulnerabilities can appear in many types of applications, so vigilance is key. For top-quality interior transformations, check out fit out contractors Dubai!"
ReplyDelete