The scenario:

I have an application which takes user input and reflect everything to the following field in response.

<textarea rows="5" cols="32" name="test_name" tabindex="6">user input </textarea>

  1. All the user input except less than (<) and greater than (>) special characters are reflected.
  2. < & > are sanitized in response by html encoding them (&lt, &gt).

Theory, History and the whole story:

In theory to demonstrate XSS, I have to get an alert window. I am listing down the ideal test cases I have tried out. I would like to know if I missed something here.

  1. Branch 1: Try to encode < & > Tried - URL encoding Result - Failed
  2. Branch 2: Try to find alternate ways I know that I could have gotten a script executed if my script landed inside a tag like by using onmouseover, onclick etc.

The Question:

  1. Would XSS be possible in this scenario?
  2. What other encoding can I try? [ suggest me payloads ]
  3. Is there any other way, like onmouseover & onclick which will work outside the < & > tags?
  • This question has been asked multiple times before, eg here: XSS payload without using < and >. – tim Mar 23 '17 at 18:17
  • @tim is right. To keep this question open you'd have argue why this is any different from an ordinary XSS attempt outside of any tags. – Arminius Mar 23 '17 at 18:19