I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.

My focus in this question isn't how to bypass the Request.Form, I am asking how to force the XSS without receiving an error from the server.

I was trying to encode the <script>alert('xss');</script> by encoding a text (ASCII text) to Hex values. By encoding to hex values, I tried testing this %3C%68%31%3E%74%65%73%74%3C%2F%68%31%3E value, I received an alert error saying:

There was an error in loading json data.

XSS Error After Encoding

On the other side, after encoding using HTML with semicolons example: &#x3C;&#x68;&#x31;&#x3E;&#x74;&#x65;&#x73;&#x74;&#x3C;&#x2F;&#x68;&#x31;&#x3E; and injecting it in the input, I received again a Request.Form error: Request.Form Error

I found on this forum an old post for bypassing the Request.Form, but I want to force the XSS without receiving an error.

(How to bypass .Net 4.5 request validation, for an XSS attack?)

  • Without more context it is not possible to answer. What I find more worrying than any XSS though is the ability to cause hard server errors based on invalid input (the second one, the first one was handled by the application).
    – fleitner
    Commented Mar 3, 2023 at 14:31


You must log in to answer this question.

Browse other questions tagged .