0

I am testing a web application where the server accepts special characters like @#$*, but when I insert double / single quotes, the server HTML encodes it.

("test">%3Cscript%3Ealert('XSS')%3C%2Fscript%3E")

is the output from the server.

How can I bypass this HTML encoding?

closed as unclear what you're asking by S.L. Barth - Reinstate Monica, Xander, Steve, grochmal, tim Jan 10 '17 at 22:14

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The question is not clear, and needs revision. You can use markup formatting. – dark_st3alth Jan 10 '17 at 4:57
  • i am getting a reflection point in the Application where it is accepting special characters @#$, but not accepting single quotes and double quotes. – white hats Jan 11 '17 at 6:52
  • How can i by pass the server validation to execute cross-site-scripting. – white hats Jan 11 '17 at 6:53
2

If you want to exploit XSS, you need to be able to inject HTML into the page. If the < and > characters are escaped, it is not possible to inject a tag. If the " and ' characters are esacped, it is not possible to inject an attribute. So it seems the page you are testing is safe from XSS.

  • 2
    ...unless it injects data directly into (some parts of) a script tag or an unquoted attribute. – Anders Jan 10 '17 at 8:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.