So I'm evaluating a notoriously safe website for XSS exploit, but I've noticed something interesting. They ban HTML number entities ({) but not the letter kinds (<).
With the "letter" kind, it parses on the website and I can input <script> and all that, but it doesn't run.

This is my problem:
It's reading the input then as a string and even if I escape the span with </span>, it doesn't do anything.

A visual of what I'm talking about is:
<span class="sanitizedtext">[INPUT HERE]</span>

Even if I use tags, it does this:
<span class="asdf"></span><script>[my code here]</script><span></span>

While the above should break and execute, it doesn't. It just sits there, even if it's returning on the page.

I found a way to make a page accept <script>, but it just sits there because it's being read as a string, not code. (Even if I try to escape the span/div/whatever)

Sorry if I'm just bad at XSS. Thank you all in advance!

  • 1
    Fixed formatting and added TL;DR – Ryan Stewart Nov 26 '16 at 17:28

It is fine if a web page does not filter strings like &lt; because it is escaped already. Browsers know that &lt;script&gt; is not an actual script tag, but just text.


user7091295 is right. If you look at the source of the web page, it will look like &lt;script&gt; and you will understand that &lt; is the encoding for left angle bracket, de-weaponized already and the tag won't be a tag. You are sort of doing the web site's defense for it. You should look at other tags besides script What is the result of img, a, iframe, and other tags mentioned here: https://html5sec.org/ ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.