I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?

I have just begun, so what I look for when testing an XSS and determining it's properly sanitized is, when they encode input like (! @ # $ % ^ & * " '( ) > <) with HTML entities, That's really it.


It depends on how you are contracted for the test. If you work on the program anyways, then you can try as long as you feel that it gives you any value.

If you work is restricted by a certain amount of time, then I would say use your gut feeling to judge if this is the best you could spend your time.

I know this is probably not the answer you want to hear, but it really depends on the specific instance, and it's not really possible to make a general statement. Depending on your guidelines for reporting, you might be able to report that you believe that a certain output is not encoded properly, but you did not have enough time to fully develop a Proof-of-Concept.

Not the answer you're looking for? Browse other questions tagged or ask your own question.