On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing; ?type=<script<script>>alert(1)</script<script>> Which gave me a homepage which presented me with the headline-text: <script>alert(1)</script> So I am pretty close.

The Page Source had the following HTML: <h1>&lt;script>alert(1)&lt;/script></h1> So for some reason only the Less-than is transformed into &lt. As soon as I send in the &-sign the whole html-injection is filtered out.

Any suggestion on how I can bypass this. I have tried double encoding to get the real "<"-sign. Any "<"-sign sent into the URL gets converted into &lt.

I have tried suggestions from OWASPs checklist, Portswagger, Stackoverflow etc. The injection is out-of-tags. It is not in a script or html-tags, so I need to put it between tags according to me.


1 Answer 1


I take it you have a situation like this:

<h1><!-- Data is inserted here. --></h1>

That is what OWASP calls inserting "into HTML element content" in their cheat sheet. To get anything done in thet context you will need to open a tag, so you will need a <. Without that, you are toast at that specific location.

The protection they are using seem to be some weird sort of homebrew that does multiple things at once without any real strategy. But it does look like it replaces all < with &lt;. You should try the usual stuff like mixing case, throwing in whitespace at unexpected places, or using different tags (e.g. an image with onload). But if you cant get a < in there, you are not going to get anywhere.

I wouldn't be very hopeful to get anywhere at that specific injection point. But since the defence looks a bit haphazard I would keep looking for other injection points. Perhaps inside a HTML attribute, or maybe in a comment or a script tag or something like that.

  • Just refer to servletsuite.com/servlets/xssflt.htm
    – Ajay Takur
    Commented Mar 12, 2020 at 10:00
  • Is it possible to add (e.g 0025 + 0256) two symbols/bytes etc to get a "<"?
    – Aard
    Commented Mar 13, 2020 at 12:48
  • @Oskar If there is some sort of mismanagement of character encodings on the server side, you could potentially use that. But I don't think the odds are great.
    – Anders
    Commented Mar 14, 2020 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .