I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following:


The output in the page will be


So I'm looking for alternatives payloads or valid encoding, already I tryied these encoding:


Anyone have an idea about exploiting this XSS or is it possible exploiting an xss without using </> ?

  • Does this answer your question? XSS payload without using < and >
    – nobody
    Aug 10, 2021 at 18:48
  • Yes but the payloads adviced in that question don't work on the web app that I'm testing Aug 10, 2021 at 18:57
  • 1
    Maybe you missed the line "If your input isn't being reflected anywhere else, and < and > are always encoded, then you can't exploit the page via XSS."? Not every web page that allows you to inject text is vulnerable to XSS. (If thigs were always so easy, then all social media sites, and stackexchange itself would be vulnerable to XSS :).)
    – nobody
    Aug 10, 2021 at 19:02


You must log in to answer this question.

Browse other questions tagged .