I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is there any payload that could possibly execute XSS in the site that doesnot use < and >?

  • Have you tried URL Encoding? %3C and %3E – HashHazard Jul 17 '16 at 3:53
  • %3C and %3E remain as it is. They are not decoded by browser. – Abiral Jul 17 '16 at 3:57
  • What about through a proxy? (i.e. Burp) – HashHazard Jul 17 '16 at 4:09
  • Sorry I did not get you. Can you explain what do I need to do in Burp suite ? – Abiral Jul 17 '16 at 4:11
  • Use the Intercept module to intercept the request and inject your XSS payload via the proxy to bypass any client side controls. If you need more help, open a chat for this question and we can talk more. – HashHazard Jul 17 '16 at 4:14

Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using < and >), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a <script> block, or similar). If your input isn't being reflected anywhere else, and < and > are always encoded, then you can't exploit the page via XSS.

However, there might be ways to trick the server into sending un-encoded < and > without it meaning to. One way that I've seen is to send Unicode characters that aren't <> but that the server might map down to those ASCII characters before reflecting them into the output. Consider characters like ˂˃, ‹›, ≤≥, <>, all of which may get mapped to <> by a server and then not get encoded as &lt; &gt;. No guarantees, but it does happen.

  • fwiw, i've never heard of any server or client auto-converting unicode to < or >... – dandavis Jul 17 '16 at 12:31
  • @dandavis You bet there is! For instance, this could happen with punycode conversions. – Arminius Jul 17 '16 at 17:35
  • @dandavis: I've pentested a lot of web apps. It's not common, but I've seen it happen before. It's another tool for the toolbox, not a guarantee, but it's always worth checking for. – CBHacking Jul 17 '16 at 19:56
  • to clarify: sure, there may be bad code out there that outputs real angle brackets from other "stuff", but i've not encountered such in 10 years of webdev, and as such i believe it to be uncommon and obviously defective, but would be surprised if OP faces such an issue... – dandavis Jul 17 '16 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.