I have an application which takes user input and reflect everything to the following field in response.
<textarea rows="5" cols="32" name="test_name" tabindex="6">user input
- All the user input except less than (<) and greater than (>) special characters are reflected.
- < & > are sanitized in response by html encoding them (<, >).
Theory, History and the whole story:
In theory to demonstrate XSS, I have to get an alert window. I am listing down the ideal test cases I have tried out. I would like to know if I missed something here.
- Branch 1: Try to encode < & > Tried - URL encoding Result - Failed
- Branch 2: Try to find alternate ways I know that I could have gotten a script executed if my script landed inside a tag like by using onmouseover, onclick etc.
- Would XSS be possible in this scenario?
- What other encoding can I try? [ suggest me payloads ]
- Is there any other way, like onmouseover & onclick which will work outside the < & > tags?