Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :
<, >, " to their HTML entities, but not &, ) or (.It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?
No, that's not necessarily sufficient. There are many XSS vectors that can potentially still be applied, depending upon where the injection point is.
Some examples:
Injection into unquoted attribute values
Injection into attribute values quoted with a single quote (' instead of ")
Injection into CSS
Injection into Javascript
Injection into comments
... and lots more. You need to do context-sensitive escaping, and you definitely need to escape at minimum <, >, ", ', plus some more in some contexts. Go spend some time on the OWASP site; there's tons written there, and this is explained in great detail.
> would allow getting out of an HTML comment.)
-, which has an interesting effect inside HTML comments (most people don't know about the surprising behavior of HTML/SGML comments). Such attacks are not easy and probably only possible in rare circumstances, but it's better to not inject dynamic values inside comments.
sometimes they escape "alert " parameter too, then you can use something like "onMouseOver" etc and you can find the full link here. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet (try xss locators)
moreover you can use %3C insead of < and so on... try url encoding etc.
and if the text is encoded in the background, you xss may not work...
