Why doesn't XSS execute when bypassing HTML encoding?

Question

I am trying to execute an XSS payload on a search field that takes my input like this:

<input name="q" id="gsasearch" type="text" value="My Input"></input>

Observations:

1. <, > and " are filtered. However, HTML encoding these characters work.
2. The input is URL encoded and URL decoded and displayed to me.
3. There are no parameters.

Payloads used is HTML encoded version of is qq"><script>alert('xss')</script>.

However, all i see in the result page is qq"><script>alert('xss')</script>.

XSS doesn't execute in both Chrome and IE. If I inspect the element, I see this:

<input name="q" id="gsasearch" type="text" value="qq"><script>alert('xss')</script>"></input>

After using F2 in dev tools, I could see that " is getting converted to ", as shown below:

<input name="q" id="gsasearch" type="text" value="qq**&quot;**><script>alert('xss')</script>"></input>

So,

I/p--> URL encoded --> URL decoded --> HTML encoded if its a "

Is there any way to bypass this?

Answer 1

The developer console and the "inspect element" functionality of the browser is not a good way to check for XSS. This will show unencoded HTML elements, even though they are really properly encoded:

When pressing F2 or selecting "Edit as HTML", it properly shows the encoded characters:

Answer 2

Is there any way to bypass this?

It depends on the application. There are multiple ways;

1. Submitting different encoded version of "

You can try URL encoding i.e. %22, double URL encoding i.e. %2522, Unicode equivalents, etc.

2. Submitting multiple "

Sometimes, only the first occurrence of special chars are escaped. So, if you submit two ", the first would be encoded while the second remains as is.

Aside from bypassing ", it's also possible to trigger XSS without bypassing ", if stars are aligned. Long story short- IE parses <meta> before doing any real parsing. Thus, using <meta> tag you can define a different charset for the page and trigger XSS using that charset. Here's a live example;
https://cm2.pw/research/ie/meta.php

And, instead of viewing "Inspect Elements", you should be viewing source code instead.

Answer 3

Both Chrome and IE implement a XSS filter measures that block the most basic XSS vulnerabilities.

If you are testing if a page is vulnerable, I would recommend either testing with Firefox or running Chrome with the --disable-xss-auditor parameter in order to disable it (be careful not to have any previous instance open, or it will reuse the previous session and ignore the parameter).