While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check XSS (From RSnake's XSS cheat sheet):
and verified the source for
<XSS to see if it is vulnerable. I got
<XSSin the source which suggests that this field is vulnerable to cross site scripting.
Now I am trying to create some code which should be less or equal to 20 characters and could be executed on this field to confirm the XSS but I am finding it hard. So in this case I have basically two questions:
1: Can someone help with such piece of code?
2: To mitigate XSS, validation for max-length(15-20 characters) could be one of the options other than the combination of data validation + HTML encoding? Please assume business rules agrees with the 15-20 characters limit.
Hope I was able to explain the question and the scenario. Kindly let me know in case of any doubts.