I found an area on a site (can't disclose name) that allows you to put input, and returns it in this form:

    <strong>text here</strong>

It isn't filtered, so you can put stuff such as <img src=x>, and it will return it, but it doesn't parse it and I can't figure out why it isn't parsing it. I checked if it converts the brackets to Unicode, but it doesn't.

Does anyone know what it's doing?

EDIT: It does convert brackets to Unicode, but is it possible to bypass this filter somehow?


You need to include a lot more information, otherwise this question isn't answerable. I don't think we have a "why is XSS not working" question, so I'll try to add a canonical answer here.

Why isn't XSS working?

So you have a website, it takes your input and echoes it back to you. This could be vulnerable to XSS! But if you do enter a payload, it isn't executed. What now?

Here are the questions you should try to answer:

  1. Encoding: How is the input actually returned?: The important part isn't how the input looks to you once the browser parses it, but how the source code looks. So you should look at that. Either use an interception proxy (ZAP, Burp, etc), or check out the source code in your browser. Are relevant characters such as <, >, ", ' actually returned like that? Or are they encoded, eg as &lt; and so on. If they are encoded, the website is likely not vulnerable (you could try different encodings, etc to bypass the encoding, but it's unlikely).
  2. Filtering: Is the input changed in any other way?: So relevant characters are not encoded, meaning that you have an HTML injection at a minimum. Now you need to check if you can enter a Javascript context. Are tags like <script> filtered? Can you use event attributes such as onMouseOver? Can you use other interesting HTML tags such as img, input, frame, etc? Filtering is often broken, so even if simple things are filtered, investigate further.
  3. Browser Filters: Why isn't my payload executing?: Ok, you now know that the website is vulnerable, you have your nice payload like alert(1), but nothing is happening. Have you disabled your browsers XSS filter? If in doubt, use Firefox without plugins, as it doesn't have a filter.
  4. HTTP Header: You know that the site is vulnerable, you know that your browser will execute XSS payloads, but still, nothing is happening? Then you should check the HTTP header. Is a CSP set? Could it prevent execution of inline scripts? If so - and you cannot upload .js files to a trusted origin -, this is still a vulnerability, but you can only target older browsers or are left with a HTML injection (which - while less severe than XSS - is still plenty powerful).

Not the answer you're looking for? Browse other questions tagged or ask your own question.