I'm penetration testing a website right now (they have a policy and a system for it), and I noticed that the search feature filters brackets.
After some messing around, I also noticed if you search this:
<%20> it returns to the home url (
However, if you use this specific combination of characters:
<&#anynumberorletterhere it will return the text after the ampersand in that home url. For example, if you search
<&#hi it will go to the homepage with the url
example.com/home#hi. It also returns special characters, such as
!@#$%^&*() completely unfiltered.
I'm sorry if this isn't enough detail, but I don't want to expose any information leading to what website it is in particular. If you need more info, please just ask below.
Essentially I'm wondering if there's any reason to report this. Also, if you have a payload you would like me to test, I'd be happy to do so and tell you the results.