Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like
<img src="aa" onerror="alert(1)"> but still no luck. This is for a CTF challenge btw.
The regex is:
<[\s\S]*> and the validator is running on a TypeScript server
asked Jun 11, 2021 at 5:56
2111 silver badge22 bronze badges
This filter doesn't reject unclosed tags, so you could inject:
<img src="x" onerror="alert(1)"
The tag will be closed as soon as the parser encounters a ">", which is obviously quite common in HTML contexts.
answered Nov 8, 2021 at 13:29
Benoit EsnardBenoit Esnard
14.6k77 gold badges6868 silver badges6666 bronze badges
https://owasp.org/www-community/xss-filter-evasion-cheatsheet has a section on alternative characters to
<. Here is a summary:
- <, <, <, <, <, <
(and try with a
; on the end)
Also, variations on the same zero padding theme above bu with hex:
- <, <, <, <
- \x3c, \x3C, \u003c, \u003C
answered Jun 11, 2021 at 11:10
You must log in to answer this question.
Not the answer you're looking for? Browse other questions tagged