So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a value="ourinput" but since we can't use " and we can only use ' then i can't escape from inside of value

what should i do? they gave us this website as a homework for XSS and i doubt we have to exploit the web server, but either way the webserver is Apache/2.4.29 and i know this version has a exploit but i couldn't find what exactly is the exploit, the CVE doesn't have detail

so basically there is nothing i can do if they use htmlentities and the only input available is between tags and the ones that are inside tags are surronded by " "?

the previous answers regarding this question was only if the web page is UTF7 we can exploit it, but its UTF8

and to clarify again, our input is only inside a tag for example < tr >ourinput< / tr > and one instance of being inside a tag attribute < a value="ourinput" > and i don't have access to the web server or source code of php

i also tried encoding the input with String.fromCharCode and with &#number but didn't work

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.