I know that Apache Tomcat can communicate with US_ASCII encoding, which gives an interesting vector to XSS, such as:
¼script¾alert(¢XSS¢)¼/script¾
Is there a request syntax that would make other servers possibly vulnerable in the same way?
1
-
There is Unicode half-width and full-width less-than sign, which can cause XSS in some rare circumstances involving compatibility normalisation– paj28Sep 30, 2022 at 16:45
Add a comment
|