I'm just testing a basic XSS injection attack. Given the images below, does it look like this website is vulnerable to XSS?

Is whitelisting the characters still the best practice against XSS attacks?

Form with XSS payload. Form with HTML-encoded payload.


From your screen shots, this page does not seem to be vulnerable to XSS.

The correct way to prevent XSS is by using output encoding. If a user types <script> and the page puts <script> in the HTML source, it is vulnerable to XSS. If it instead encodes that user input and puts &lt;script&gt; in the HTML source, it is not interpreted as HTML but as the text <script>.

It looks like your site does this encoding twice instead of once, and this results in displaying the encoded HTML in the text fields.


The example within the question seems to show that they're preventing the tags from being used by targeting them. E.g. <script> becoming &lt;script&gt;. However, if UTF encodes it and then SQL encodes it into something else, it's not technically secure. Therefore, using a different type of injection method can be used, which is an SQL injection and can be exploited by hex values, as shown below:

First you choose something to be encoded:

Hex Encoder

This will then be encoded to form this:

Hex Decoder

Then you can carry out the attack:

Here is an example of this from OWASP, when testing for a possible injection:

Select user from users where name = unhex('726F6F74')

Here 'root' is shown as the hex value 726F6F74


HTML.Encode() : https://stackoverflow.com/questions/1014593/html-encode-what-how-does-it-prevent-scripting-security-problems-in-asp-net

SQL Injection: https://www.w3schools.com/sql/sql_injection.asp

OWASP example1: https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Hex_Encoding

OWASP evasion: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

Another example can be found here: https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/#HexbasedSamples

  • 2
    Most of your answer is explaing a quite specific case of SQL-injeciton, which isn't what the question is about. I think you should focus on the XSS that the question is about, without getting into details about anything else. – Anders Nov 5 '18 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.