New answers tagged


The 2008 paper from Blake Franz of Leviathan Security -- -- identifies some of the original problem spaces with character sets. Some tools correctly identify and explain this problem, such as Burp Suite Professional -- ...


Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


My answer got longer than expected, so just to give you the answer: <body onpageshow="alert(1)"> probably works, and if it doesn't, <body onpaonpageonpagonpageonpageshowshoweshowshowgeshow="alert(1)"> will. How to try to bypass a custom filter You say you try to learn how to do is yourself, so here are some first steps I would take: check ...

Top 50 recent answers are included