I'm currently facing this possible reflected XSS vulnerability on a webapp:

URL = http://www.test.com/login/?login=[PAYLOAD]

When a user clicks on this link, it displays a login page that includes the following code:

<a href="http://www.test.com/login/[PAYLOAD]><img...></img></a>

I tried to close the <a> tag using > with different encodings, but this is filtered and displayed as %3E. I also tried to close the double quote and use some things like onclick etc. but this is filtered as well.

So I was wondering, is there any tool out there that can automatically test all characters in a given set with different encodings to see what is filtered ?

I could create my own script to do that, but it might save some time and well... reinventing the wheel..

So it appears that there is no tool that provide such capability. ie: test and report for every input what is filtered (and how it renders) or what is not. Burp ends up being the best solution to do that semi-manually, and a Burp extension can be done to fully automate this process.

  • Very nice and well presented a question. A well-deserved +1 from me.
    – Adi
    Oct 15, 2013 at 16:56

1 Answer 1


You could probably use Burp Suite to do this. Burp Proxy will let you intercept an HTTP request to a specific URL, http://www.test.com/login/?login=[PAYLOAD] for example.

Once you have intercepted this request you can specify which of the parameters you would like to target using Burp Intruder(in this case login).

Next you can specify a payload that you would like to apply to this parameter. You can choose from a number of existing payloads or you can create your own.

When you begin the attack it will fire a request with every item in your payload set and give you a number of options for examining the result, such as grepping for the payload to see if it made it through intact.

Hope this helps!

  • Reason for downvote? Oct 15, 2013 at 17:48
  • I was wondering as well ? I'll try with Burp Intruder tomorrow, i'm unsure the grep part can be automated as I'd like. I want to see if I can still escape the <a> tag for this particular case, but basically what I would like also is a list, for each input, of what's filtered / what's not.
    – ack__
    Oct 15, 2013 at 18:10
  • 2
    Right on, let me know how it turns out! The grep functionality may work for your needs. Basically you would grep the response to see if the un-encoded character is in there. So if you submit > in the payload you would grep for <a href="http://www.test.com/login/>. If it is encoded the response will contain <a href="http://www.test.com/login/%3E instead, so it will say there is no match. Let me know if that is confusing. Oct 15, 2013 at 19:57
  • So I did this with Burp Intruder for this particular test and it worked fine, but after looking everywhere it appears there's no software/plugin to do this automatically on every input you want. Thank you anyway I'll mark this as the right answer.
    – ack__
    Oct 19, 2013 at 9:10
  • Hrrm, you should be able to specify your own input file. I use the pay version so maybe that is a paid feature? Oct 19, 2013 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .