I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this question isn't how to bypass the Request.Form, I am asking how to force the XSS without receiving an error from the server.
I was trying to encode the <script>alert('xss');</script> by encoding a text (ASCII text) to Hex values. By encoding to hex values, I tried testing this %3C%68%31%3E%74%65%73%74%3C%2F%68%31%3E value, I received an alert error saying:
There was an error in loading json data.
On the other side, after encoding using HTML with semicolons example: <h1>test</h1> and injecting it in the input, I received again a Request.Form error:
I found on this forum an old post for bypassing the Request.Form, but I want to force the XSS without receiving an error.
(How to bypass .Net 4.5 request validation, for an XSS attack?)
