Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?


The approach for evading a filter, is completely dependent upon the filter(s) that are being used and which type of XSS scripting attack is being performed.

According to OWASP, "Both reflected and stored XSS can be addressed by performing the appropriate validation and escaping on the server-side"

Input filtering is not be enough to prevent XSS, and here is a list of tests to run to see if filtering is broken.

| improve this answer | |
  • what is actually happening is when i give < as input it is getting url encoded and sent to server,then the server decodes it and then santitizes anything after < character. And the out is returned But what is being returned is url encoded.Is there a way to beat this? – wandrer Apr 25 at 5:52
  • Honestly, it depends on where you are trying to inject it. If you are trying to inject it into JavaScript then their probably is, but you would have to look at the cheat sheet I provided and test some options against your target. If you trying to inject a script tag into the DOM, it may not be possible, but there are some tricks (again, mentioned in that cheat sheet) by using different character encodings. You will just have to use trial and error and see how the target system responds. – iraleigh Apr 26 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.