On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing;
Which gave me a homepage which presented me with the headline-text:
<script>alert(1)</script> So I am pretty close.
The Page Source had the following HTML:
So for some reason only the Less-than is transformed into
<. As soon as I send in the &-sign the whole html-injection is filtered out.
Any suggestion on how I can bypass this. I have tried double encoding to get the real "<"-sign.
Any "<"-sign sent into the URL gets converted into
I have tried suggestions from OWASPs checklist, Portswagger, Stackoverflow etc. The injection is out-of-tags. It is not in a script or html-tags, so I need to put it between tags according to me.