XSS payload without using < and >

Question

I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is there any payload that could possibly execute XSS in the site that doesnot use < and >?

Answer 1

Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using < and >), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a <script> block, or similar). If your input isn't being reflected anywhere else, and < and > are always encoded, then you can't exploit the page via XSS.

However, there might be ways to trick the server into sending un-encoded < and > without it meaning to. One way that I've seen is to send Unicode characters that aren't <> but that the server might map down to those ASCII characters before reflecting them into the output. Consider characters like ˂˃, ‹›, ≤≥, ＜＞, all of which may get mapped to <> by a server and then not get encoded as < >. No guarantees, but it does happen.