I'm checking for reflective XSS in a website and have noticed that the website uses the concept of HTML escaping, so basically any special/invalid characters are escaped. So injecting is not that easy.
' gets converted to
> gets converted to
I had two questions:
1) Is it possible to bypass this type of filter?
2) Also I have noticed that when you intercept the response after the filter has escaped the payload used, the website allows the response to be tampered. (Basically it allows the user to replace the escaped version of the payload seen in the response to the original payload, hence executing the pop-up to get hostname, cookie, domain etc.) Although I guess this is not exactly how XSS works, I am still able to get some info about the website.