-4

This question already has an answer here:

i was trying to exploit a website using XSS, but whenever I try an injection containing <, >, / or * I get the following message:

Server Error in '/' Application

I think website is trying to protect against XSS commands using something like a plugin or a code or a services. I want to know how to bypass this to do XSS.

marked as duplicate by Jeroen - IT Nerdbox, Tobi Nary, Xander, Anders, Rory Alsop Apr 29 '18 at 11:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Add ?bypassFilters=true to the URL and you should be good to go...... – Jeroen - IT Nerdbox Apr 15 '18 at 9:43
  • 4
    Voted to close this as it seems to be breaking/bypassing a security system which we will not help you with. – Jeroen - IT Nerdbox Apr 15 '18 at 9:44
  • I have permission to do so – kinan nagariya Apr 15 '18 at 9:57
  • 1
    Still, it would be good to not get text in pictures. Or at least crop them to remove irrelevant parts. – Anders Apr 15 '18 at 12:40
1

What you are encountering is the IIS Request Validation protection. By the looks of it, you have not actually found an XXS/HTML-injection vulnerability, but are only hammering the Request Validation protection that blocks your potentially bad requests.

Reflected XXS is hard to exploit, because of the different protection mechanisms in browser and in your case, also on the server side. See this question for chrome XXS protection.

So in order for you to probe if this server actually have reflected HTML-injection vulnerabilities, you have to either ask the administrator to disable request-validation, or try to use innocent data in your payloads.

If I recall correctly, IIS Request Validator allow you to try less harmful HTML tags. I do not remember what works, but you have to experiment. If that string is reflected, it is a good chance that the underlying application is vulnerable, but still hard to exploit due to the protections on web-server and web-browser.

In your particular case, you are sending characters that are blacklisted in the path segment of the URI.

  • i had scanned the site using zap in kali and that show me that the site is using some kind of mechanism for protection against xss . – kinan nagariya Apr 16 '18 at 5:44
  • Yes, it is called Request Validator, which is provided by IIS web server – Dog eat cat world Apr 16 '18 at 16:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.