I am trying to pentest a dummy website that has a form with a
TEXTAREA input on one page.
When the form is submitted, the contents of the form are displayed on a second page.
However, the second page that receives the POST input, filters it to replace
The second page also has a:
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
I used Fiddler to intercept the POST from the first page and modified the request header from
Content-Type: application/x-www-form-urlencoded; charset=UTF-7
And changed the POSTed content to:
Hoping that it would decode to:
However, it didn't do anything and text showed up as it is. Also, the text-encoding of the second page was recognized as UTF-8. I guess that's because it has a meta tag in it's HTML with the charset set to UTF-8.
I want to know if there's a way this page can be exploited through XSS and if there is, what would be the input vector?