Xss filter bypass ><script>alert(1);</script> [duplicate]

Question

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes are encoded.

payload = <script>alert(1)</script>

response =

<h1 class="StoreTitle__StyledStoreTitle-qk8d4w-0 dRnViH">&lt;script&gt;alert(1)&lt;/script&gt;</h1>

Answer 1

There is no default way/trick to bypass this. However you can try to identify if there is a regex in place that you can break. Or if there are any normalization/decoding inconsistencies.

Some ideas:

1. Check if the encoding happens recursively. if you provide multiple '<', will they all be encoded?
2. Try different types of encoding (e.g. url encoding, double URL encoding) and see how the application treats them.
3. There are cases were the application normalizes Unicode characters (have a look here Unicode Normalization Bypass)