I'm using the mutillidae to increase my hacking skills. I am trying to exploit the XSS in the username field in the registration form field with the toogle security 5. I tried everything that I know, but I still didn't manage to exploit it.

From the inspect element of that field (username):

<input htmlandxssandsqlinjectionpoint="1" name="username" size="15" autofocus="autofocus" minlength="1" maxlength="15" required="required" title="" type="text">

Can anyone please tell me why the payloads didn't work? What filters are in use?

1 Answer 1


For starters, the HTML input tag in this case is set to restrict input to 15 characters, so your standard <script>alert(1);</script> won't fit. This can probably be circumvented by using an attack proxy such as OWASP ZAP or Burbsuite, which will allow you to submit responses that wouldn't normally be accepted.

There is no way to tell what server-side filters are in place by simply looking at the HTML code. HTML is client-side, and client-side security can almost always be bypassed. (Much like the character limit described above.) It is likely that there are multiple layers of filtering that go on in the server after you submit the form.

There are two steps that you should try. First, rather than starting off with a whole payload script, try just entering specific characters and combinations of characters, such as < and >. See what characters get filtered out, and which ones become encoded or remain unfiltered. Then try to craft an attack string that will bypass the filtering or is the decoded form of what you actually want.

The other thing you should do is to run a fuzzer on the application. This will try a very large number of different attack strings, to try to find one that gets by the filtering.

  • but the request is not submitted so i can't see the response, because of this error, Blacklisting is l33t like l33tspeak. @Kernel Stearns May 2, 2017 at 12:17
  • 1
    Could you clarify what request you submitted, and what the error code was? Maybe you should do some research as to whether other people have had trouble with that same problem in Mutillidae.
    – B00TK1D
    May 2, 2017 at 13:08

Not the answer you're looking for? Browse other questions tagged .