test.php?p=test give output:
I can inject anything other than '<', when injected I got redirected. So can it be exploited ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
In this particular case, the "<" is necessary to an attack. Keep in mind that the "<" isn't necessary to all species of XSS attacks. A good reference is here.
As Ammar mentioned, in this specific situation I don't think that XSS is possible. However if visiting
test.php?p=test rendered the following HTML:
<p style="..." title="test">Some other stuff</p>
A malicious user could potentially use a URL like this:
<p style="..." title="test" onmouseover="alert('xss')">Some other stuff</p>
to execute an XSS attack. Doesn't work in your situation, but should illustrate the fact that stripping brackets is not sufficient to prevent XSS.
As other comments mentioned, you have to be able to inject '<' in this particular example. I would try Unicode encoding(html entities).
For example inject
<test and see if server's response contains
Sometimes URL encoding also work. For example, some sites blacklist characters such as
; in order to prevent unicode encoding based xss vectors.
To bypass this filter you can use url encoding.
would translate to
If the charset is UTF-7, the sequence
+ADw- can be used to represent
Current versions of Internet Explorer still support UTF-7. However, the page would need to already be set as the UTF-7 charset or there would need to be some type of vector to allow you to set it in order to exploit this.
Other than that, a less than character is necessary to exploit this in HTML element context. This is not the case with attribute context where if the context can be changed to another attribute, then one supporting script can be injected:
<img alt="usertext" />
set usertext to
then this will render as
<img alt="" onmouseover="alert('xss')" />