I am trying to perform XSS on the injection point marked with XXXX here:

  <textarea name="billing[something]" id="billing-something" rows="1" 
    type="phone" title="something" placeholder="something" cols="80">

I can reflect any input, except < or >. All characters after those will be removed. Can I perform any kind of XSS?


  • If i introduce XXXX>XXXX I will obtain XXXX
  • XXXX[[>]>/// I will obtain XXXX[[
  • XXXX[[<]</// I will obtain XXXX[[

In other places in this application I was able to exploit inputs using payloads like nsehe"onfocus="alert(1)"autofocus="e2c00 because of <input value=".. fallback.

  • 1
    have you exhausted this? : owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
    – TheHidden
    Apr 20, 2018 at 9:53
  • @TheHidden most of them are by defaults fails (becouse of <> ) but yes and also tried diffrent encodings. Apr 20, 2018 at 10:06
  • 3
    You can't create new tags without angle brackets. If they are always filtered out, then there is no indication this is exploitable.
    – Arminius
    Apr 20, 2018 at 13:14

1 Answer 1


There are actually a lot of other ways you can use XSS, for example you can convert characters to either their hex or ASCII equivalents, an example is here:


which is the equivalent of an alert box that says hi


EDIT: This blog can be quite useful for bypassing filters: https://alihassanpenetrationtester.blogspot.ie/2013/01/bypassing-xss-filters-advanced-xss.html

  • 2
    You are assuming that the XSS filter is performed on the query string parameter before it is URL decoded. That is usually not the case.
    – Anders
    Apr 20, 2018 at 15:43
  • also as I told above, encoding I already checked and is not working at all. It just remove the "<" or ">" and the text after it. Apr 22, 2018 at 22:05
  • do you haveTried %3<C ? Aug 26, 2020 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.