I know that Apache Tomcat can communicate with US_ASCII encoding, which gives an interesting vector to XSS, such as:


Is there a request syntax that would make other servers possibly vulnerable in the same way?

  • There is Unicode half-width and full-width less-than sign, which can cause XSS in some rare circumstances involving compatibility normalisation
    – paj28
    Sep 30, 2022 at 16:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.