I recently became the security administrator of a website. I'm not a security master, but I took it as a chance to actually understand how security works nowadays.
The website has a chat function, and I was wondering "Is this chat vulnerable to XSS?" So I tried to see which characters are escaped because since the chat is a prefab, nobody can tell me how it works. I found that the <> are escaped, however I can use the command:
[img]www.anywbsite.com/image.jpg[/img] and it will show a preview of the image on the chat.
This way it seems pretty safe, the problem is that I can put any url at all, even urls that do not exist, as long as it has a "www" and a ".com" at the end it will run the command.
I was wondering, is there any way I can form a url into a script? or something like that.