I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I can get arbitrary JS into the page.
While stored XSS is a mild finding I wanted to see if I could change the page in more meaningful ways like adding
%> tags to change the underlying Ruby code. Sadly any input like that has been returned HTML encoded meaning they are filtering it out. I don't think it's a whitelist approach because they will allow junk tags like
<s></s>. It seems the filter is finding rouge
< characters all alone and any tag with a meaningful character so
Has anyone seen filters like these before and know of any evasion tactics?