i was trying to exploit a website using XSS, but whenever I try an injection containing <, >, / or * I get the following message:

Server Error in '/' Application

I think website is trying to protect against XSS commands using something like a plugin or a code or a services. I want to know how to bypass this to do XSS.

  • 1
    Add ?bypassFilters=true to the URL and you should be good to go......
    – Jeroen
    Commented Apr 15, 2018 at 9:43
  • 4
    Voted to close this as it seems to be breaking/bypassing a security system which we will not help you with.
    – Jeroen
    Commented Apr 15, 2018 at 9:44
  • I have permission to do so Commented Apr 15, 2018 at 9:57
  • 1
    Still, it would be good to not get text in pictures. Or at least crop them to remove irrelevant parts.
    – Anders
    Commented Apr 15, 2018 at 12:40
  • related: security.stackexchange.com/questions/183755/…
    – rubo77
    Commented Jun 3, 2020 at 20:53

1 Answer 1


What you are encountering is the IIS Request Validation protection. By the looks of it, you have not actually found an XXS/HTML-injection vulnerability, but are only hammering the Request Validation protection that blocks your potentially bad requests.

Reflected XXS is hard to exploit, because of the different protection mechanisms in browser and in your case, also on the server side. See this question for chrome XXS protection.

So in order for you to probe if this server actually have reflected HTML-injection vulnerabilities, you have to either ask the administrator to disable request-validation, or try to use innocent data in your payloads.

If I recall correctly, IIS Request Validator allow you to try less harmful HTML tags. I do not remember what works, but you have to experiment. If that string is reflected, it is a good chance that the underlying application is vulnerable, but still hard to exploit due to the protections on web-server and web-browser.

In your particular case, you are sending characters that are blacklisted in the path segment of the URI.

  • i had scanned the site using zap in kali and that show me that the site is using some kind of mechanism for protection against xss . Commented Apr 16, 2018 at 5:44
  • Yes, it is called Request Validator, which is provided by IIS web server Commented Apr 16, 2018 at 16:22

Not the answer you're looking for? Browse other questions tagged .