The developer filter the characters ', <, > and = and the vulnerability is something like:

I also tried URL encodes like %3c, %0a, %3e, %0a, %3d, %0a, %27 and %0a but it doesn't work. Without filters I can get XSS like ">alert("aaa").

Any ideas about how to bypass?

closed as off-topic by Tobi Nary, tim, ISMSDEV, Serge Ballesta, Steve Nov 20 '17 at 16:16

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Tobi Nary, ISMSDEV, Serge Ballesta, Steve
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Where is your injection point? – Arminius Nov 18 '17 at 13:41
  • Related – Joe Nov 18 '17 at 15:46
  • 1
    Something like " onclick="..."? – CodesInChaos Nov 18 '17 at 19:01
  • going for hover on a screen sized element might work even better. – CodesInChaos Nov 18 '17 at 19:35
  • @CodesInChaos only if injection point already inside html tag – TiredOfProgramming Jan 29 at 20:39

Browse other questions tagged or ask your own question.