I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is there any payload that could possibly execute XSS in the site that doesnot use < and >?

  • Have you tried URL Encoding? %3C and %3E
    – HashHazard
    Commented Jul 17, 2016 at 3:53
  • %3C and %3E remain as it is. They are not decoded by browser.
    – Abiral
    Commented Jul 17, 2016 at 3:57
  • What about through a proxy? (i.e. Burp)
    – HashHazard
    Commented Jul 17, 2016 at 4:09
  • Sorry I did not get you. Can you explain what do I need to do in Burp suite ?
    – Abiral
    Commented Jul 17, 2016 at 4:11
  • Use the Intercept module to intercept the request and inject your XSS payload via the proxy to bypass any client side controls. If you need more help, open a chat for this question and we can talk more.
    – HashHazard
    Commented Jul 17, 2016 at 4:14

1 Answer 1


Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using < and >), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a <script> block, or similar). If your input isn't being reflected anywhere else, and < and > are always encoded, then you can't exploit the page via XSS.

However, there might be ways to trick the server into sending un-encoded < and > without it meaning to. One way that I've seen is to send Unicode characters that aren't <> but that the server might map down to those ASCII characters before reflecting them into the output. Consider characters like ˂˃, ‹›, ≤≥, <>, all of which may get mapped to <> by a server and then not get encoded as &lt; &gt;. No guarantees, but it does happen.

  • fwiw, i've never heard of any server or client auto-converting unicode to < or >...
    – dandavis
    Commented Jul 17, 2016 at 12:31
  • 1
    @dandavis You bet there is! For instance, this could happen with punycode conversions.
    – Arminius
    Commented Jul 17, 2016 at 17:35
  • @dandavis: I've pentested a lot of web apps. It's not common, but I've seen it happen before. It's another tool for the toolbox, not a guarantee, but it's always worth checking for.
    – CBHacking
    Commented Jul 17, 2016 at 19:56
  • to clarify: sure, there may be bad code out there that outputs real angle brackets from other "stuff", but i've not encountered such in 10 years of webdev, and as such i believe it to be uncommon and obviously defective, but would be surprised if OP faces such an issue...
    – dandavis
    Commented Jul 17, 2016 at 23:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .