I am performing testing on a site that takes input from the user and places it between
> from the user are encoded as
>. Is there any payload that could possibly execute XSS in the site that doesnot use
Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using
>), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a
<script> block, or similar). If your input isn't being reflected anywhere else, and
> are always encoded, then you can't exploit the page via XSS.
However, there might be ways to trick the server into sending un-encoded
> without it meaning to. One way that I've seen is to send Unicode characters that aren't
<> but that the server might map down to those ASCII characters before reflecting them into the output. Consider characters like
＜＞, all of which may get mapped to
<> by a server and then not get encoded as
< >. No guarantees, but it does happen.