I have a parameter, let's call it p which normally accepts true or false as a string.

I can send the following command and it will be printed, the only thing hindering the script from executing is the %-sign after <.


And here is the problem, I can only send scripts that will not execute. If I send correct html/script the server returns HTTP/1.1 200 OK but with an empty response. But since the server accepts <> I don't wan't to give up just yet.

From the responses I have sent, I think that < must be followed by a non alphabetical character in order for the code to execute, or %** except for some values ex %2f and %21. I can send in URL-encoded values that is printed as clear text in the application but no alphabetical character that I have tried works, for example %73 for s returns an empty response.

Any ideas what I can try more?

Sample of the things I have tried:

Request returns response:


Empty response:


If I send requests with %0* or %1* i get: HTTP/1.1 500 Internal Server Error. However the error that is printed states Bad Request


400 Bad Request - Illegal XML character found among arguments: facets: p:<%script>alert(1)<\u001Escript>


1 Answer 1


This question concerns a specific WAF bypass, for which the answer is really dependent on the exact implementation and thus cannot fully be answered.

Deriving from your inputs, this WAF appears to be a pretty solid solution to prevent XSS.

A few samples I am missing from the list:

  • Payloads using capitalization
  • Payloads using XML-like tags, e.g. <?XML ?>
  • Payloads using various Unicode characters

Although it is not unlikely the WAF was correctly implemented in this scenario.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .