Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site only takes the text until the first forward slash appears, making it seemingly impossible to close the title tag. I already tried %2F, but the server appears to convert that to a forward slash and therefore cut the input there. This is possibly mod_rewrite, but without AllowEncodedSlashes.

Example: domain.com/subfolder/myXss</title>bla will lead to ...<title>myXss<</title>

So my question is whether one of these two is possible:

  • Can i encode a forward slash in some other way?
  • Can I somehow close the title tag or insert malicious code into the title tag? I can't simply insert script, as nothing else is allowed within the title tag.
share|improve this question
1  
It's a long shot, but have you tried double-escaping %252F? (Or possibly even triple-escaping maybe?) –  LB2 May 30 at 13:46
1  
We would need to see the backend code to see what filters are in place, if you are just checking for the slash, then is possible some special or escape characters would lead to XSS. –  Eric G May 30 at 14:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.