I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page.

For example XML file looks like this:

<?xml version="1.0" encoding="utf-8"?>
<Request xmlns="http://www.w3.org/1.0">
<Body CaseId="Test/123656">
    <person gender="female">
    <note date="2008-01-10">

The value of CaseID, gender and date is than presented on another page. Is it possible to send somehow XSS payload in attribute value if web application blocks "<"? I would like to test also XXE, is it possible to reference to external entity in attribute value?

  • it depends on how the data is displayed. you can use attrib events to own instead of script tags. – dandavis Nov 17 '17 at 20:02

XML Parsers usually interpret Unicode so you could use the format \u00HH and bypass validations for <>,for example:


When XML Parser read the data structure to show on view, then it interprets the Unicode Characters and the result is the following:


I hope this information helps you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.