I found a website that reflected back the user inputs. But the problem is when I inject this payload <svg/onload=alert(1)> I get an error.

But when I use this payload <%20svg/onload=alert(1)>, my input reflects back to the screen but I can't make the alert pop up. And this document says that there should not any white space between < and the tag name.

So I can't use any payload which starts with < and tag name for ex. <script, <svg, <img

So, Is there any trick?

Tried payloads:


But the result same, my input reflects back without any problem, but no alert pops up.

So, Is the result is "It can't bypass"? What am I missing here?

  • What is the "error" you get? Why not simply injecting <script>alert(1) instead? – Xenos Jul 3 '18 at 8:08
  • Hi @Xenos, I have clearly defined the problem in the question above, please read it again. And I am getting the 404 error. – Utkarsh Agrawal Jul 3 '18 at 8:55
  • I suspect the 404 is because your attempt to inject things is wrongly done and the URI no longer targets the right document. Please provide the full URI for all attempts, as long as the part of the response document that matches these attempts. You also did not answer why you're not injecting a script tag directly instead of a svg tag (not to mention that what you really "inject" yourself is unclear). – Xenos Jul 3 '18 at 9:21
  • Okay let me explain you, What I said in the question is when I inject <svg/onload=alert(1)> at the parameter it says 404 error, Now when I use this payload <%20svg/onload=alert(1)> then my input reflects back with out any problem. Now What the problem is I can't use any payload which starts it with < and then the tag name i.e. <svg <script <img because there is a filter in the web application. So I need a trcik – Utkarsh Agrawal Jul 3 '18 at 11:59

Assuming the situation is:

A webpage directly insert part of the URI inside its HTML content

and the restriction is:

Webpage returns a static error if that URI part contains <[a-zA-Z0-9]

Then you could have XSS exploit in these case:

  • Code is inserted inside a <script> tag in the page, inside a <style> tag, inside some HTML attributes like href or onclick, or between the < and > of any HTML tag: in all those cases, you don't need to use <XYZ-like code to inject critical stuff
  • Code is inserted in a textNode of any other HTML element: you can inject </xyz> tags, which breaks the page and might allow some other injections below, same goes for <!-- comment tags; or you can inject _ starting nodes (might have some impact one way another); or you can inject a string starting with any letter and containing the tag later (foo<bar>naz</bar>)
  • And why not encoding the 1st tag character? Or switching case? Or both? Did you try <Script>... or <%53cript?

Still, accurate helping would be far easier with a mapping of "This is the URI I've used, and that is the HTML result I get" (but I'm unsure we would get really further than this, since goal of this website is not to provide exploits for attacks AFAIR).

  • I respect your efforts, but I think this filter is safe. Because I tried all the things as you said and other people too. So, thank you. :) – Utkarsh Agrawal Jul 3 '18 at 19:29
  • 1
    @UtkarshAgrawal IMO, we still lack a lot of information to tell "it's safe". But welcome anyway. – Xenos Jul 4 '18 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.