As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes are encoded.

payload = <script>alert(1)</script>

response =

<h1 class="StoreTitle__StyledStoreTitle-qk8d4w-0 dRnViH">&lt;script&gt;alert(1)&lt;/script&gt;</h1>
  • We have several versions of this question on this site.
    – schroeder
    Commented Jan 11, 2021 at 13:32
  • Bypass "<" and ">" using < and > Unicode Character U+FF1C and U+FF1E
    – Boschko
    Commented Jul 15, 2022 at 17:35

1 Answer 1


There is no default way/trick to bypass this. However you can try to identify if there is a regex in place that you can break. Or if there are any normalization/decoding inconsistencies.

Some ideas:

  1. Check if the encoding happens recursively. if you provide multiple '<', will they all be encoded?
  2. Try different types of encoding (e.g. url encoding, double URL encoding) and see how the application treats them.
  3. There are cases were the application normalizes Unicode characters (have a look here Unicode Normalization Bypass)

Not the answer you're looking for? Browse other questions tagged .