Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.

  • 3
    What's your injection context? – Arminius Jul 14 '18 at 15:16
  • @Arminius It is .net app which blocks xss using <> and generates an potentially dangerous error for this. – Tushar Jul 15 '18 at 14:53
  • Have you tried encode or even double encode your input? Encode might work if the application does not use ".NET AntiXSS Library" ( owasp.org/index.php/.NET_AntiXSS_Library ) – Pilfility Jul 16 '18 at 10:53
  • I think @Arminius meant where your injection is interpreted, for example, if your injection is part of JavaScript code or inside of a HTML event (onclik, onload, etc), you don't need to use HTML tags, you could inject JS code directly. – hmrojas.p Jul 16 '18 at 17:58
  • you can't; you need an HTML context to perform XSS and you don't have HTML. – dandavis Jul 16 '18 at 18:14

This might not prove successful but perhaps you can try something like the following as it does not use the specific tags (<>) you are referring to:


This was found from the below OWASP source for attempting XSS by filter evasion techniques

Source: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.