Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site only takes the text until the first forward slash appears, making it seemingly impossible to close the title tag. I already tried %2F, but the server appears to convert that to a forward slash and therefore cut the input there. This is possibly mod_rewrite, but without AllowEncodedSlashes.

Example:</title>bla will lead to ...<title>myXss<</title>

So my question is whether one of these two is possible:

  • Can i encode a forward slash in some other way?
  • Can I somehow close the title tag or insert malicious code into the title tag? I can't simply insert script, as nothing else is allowed within the title tag.
share|improve this question
It's a long shot, but have you tried double-escaping %252F? (Or possibly even triple-escaping maybe?) – LB2 May 30 '14 at 13:46
We would need to see the backend code to see what filters are in place, if you are just checking for the slash, then is possible some special or escape characters would lead to XSS. – Eric G May 30 '14 at 14:09

You can try a lot of things it depends what the server is doing. Double encoding, Hex encoding. If I was looking at this my first though would be how can I do it without a backslash.

The title tag doesn't need to be closed, you just need to be able to get in to javascript context.

In other words you would be abled to insert script alert(xss) /script (won't let me add the opening and closing script tags) and it would execute if the slash was allowed, you wouldn't need to close the html tag.

How about something like %3Csvg%20onload%3D%22alert(%27xss%27)%22%3E

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.