I am trying to perform XSS on the injection point marked with XXXX here:

  <textarea name="billing[something]" id="billing-something" rows="1" 
    type="phone" title="something" placeholder="something" cols="80">

I can reflect any input, except < or >. All characters after those will be removed. Can I perform any kind of XSS?


  • If i introduce XXXX>XXXX I will obtain XXXX
  • XXXX[[>]>/// I will obtain XXXX[[
  • XXXX[[<]</// I will obtain XXXX[[

In other places in this application I was able to exploit inputs using payloads like nsehe"onfocus="alert(1)"autofocus="e2c00 because of <input value=".. fallback.

  • 1
    have you exhausted this? : owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
    – TheHidden
    Apr 20, 2018 at 9:53
  • @TheHidden most of them are by defaults fails (becouse of <> ) but yes and also tried diffrent encodings. Apr 20, 2018 at 10:06
  • 3
    You can't create new tags without angle brackets. If they are always filtered out, then there is no indication this is exploitable.
    – Arminius
    Apr 20, 2018 at 13:14

1 Answer 1


There are actually a lot of other ways you can use XSS, for example you can convert characters to either their hex or ASCII equivalents, an example is here:


which is the equivalent of an alert box that says hi


EDIT: This blog can be quite useful for bypassing filters: https://alihassanpenetrationtester.blogspot.ie/2013/01/bypassing-xss-filters-advanced-xss.html

  • 2
    You are assuming that the XSS filter is performed on the query string parameter before it is URL decoded. That is usually not the case.
    – Anders
    Apr 20, 2018 at 15:43
  • also as I told above, encoding I already checked and is not working at all. It just remove the "<" or ">" and the text after it. Apr 22, 2018 at 22:05
  • do you haveTried %3<C ? Aug 26, 2020 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .