Timeline for Why doesn't XSS execute when bypassing HTML encoding?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 13, 2018 at 14:34 | comment | added | xorist | You should make a new question if you want an answer to that @pratikpattanaik. Although, it may be quite a broad question, or possibly a duplicate. As bypassing things like this are a common topic in the security community while having a large opportunity for vectors. Not to mention the need to account for specific circumstances of different applications, filters, etc. | |
| Dec 12, 2018 at 10:19 | comment | added | pratik pattanaik | Thanks. There is no CSP in place. i checked using F2 and they are encoding the " character. "><script>alert('xss')</script>" > Is there anyway to bypass this ? | |
| Dec 12, 2018 at 10:18 | comment | added | Polynomial | There may additionally be a CSP in place which prevents inline scripts from executing. | |
| Dec 12, 2018 at 10:12 | history | answered | Sjoerd | CC BY-SA 4.0 |