I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :

  • It escapes <, >, " to their HTML entities, but not &, ) or (.
  • You are not in a tag, so you have to create your own.

It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?

  • 2
    Where exactly is it reflected? I.e. is it inside an attribute or text node or script tags, or style, etc..?
    – valentinas
    Dec 11, 2013 at 1:08
  • 1
    I believe this is well documented.
    – rook
    Dec 11, 2013 at 1:08
  • In addition to other answers, also see this about "mXSS attacks": reddit.com/r/netsec/comments/1skr62/…
    – domen
    Dec 11, 2013 at 13:38

2 Answers 2


No, that's not necessarily sufficient. There are many XSS vectors that can potentially still be applied, depending upon where the injection point is.

Some examples:

  • Injection into unquoted attribute values

  • Injection into attribute values quoted with a single quote (' instead of ")

  • Injection into CSS

  • Injection into Javascript

  • Injection into comments

... and lots more. You need to do context-sensitive escaping, and you definitely need to escape at minimum <, >, ", ', plus some more in some contexts. Go spend some time on the OWASP site; there's tons written there, and this is explained in great detail.

  • +1 (While you are right, I do not see where an escaped > would allow getting out of an HTML comment.)
    – freddyb
    Dec 11, 2013 at 15:36
  • @freddyb, yeah, it's tricky. For comments, the key character is -, which has an interesting effect inside HTML comments (most people don't know about the surprising behavior of HTML/SGML comments). Such attacks are not easy and probably only possible in rare circumstances, but it's better to not inject dynamic values inside comments.
    – D.W.
    Dec 11, 2013 at 19:53
  • I fully agree. Do you have any weird findings with regard to comments though?
    – freddyb
    Dec 15, 2013 at 12:13

sometimes they escape "alert " parameter too, then you can use something like "onMouseOver" etc and you can find the full link here. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet (try xss locators)

moreover you can use %3C insead of < and so on... try url encoding etc.

and if the text is encoded in the background, you xss may not work...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .