I'm testing a commenting application that takes a link of the form
http://google.com and puts it in an href tag as so:
<a rel="nofollow" href="http://google.com">
The resulting comment is stripped of
In testing, I've been attempting to utilize some form of
http://"onmouseover="alert(1); this way I would have
<a href="http://"onmouseover="alert(1);"> on the page, but it hasn't been working.
Parentheses are filtered out. I've tried various encodings.
<script>tags are filtered, but you can get around this via
Spaces can't be used (they break the tag if I use a space). I've tried ASCII and %20.
I can use a semicolon, but I have to double it if it would be the last character, and then it works fine.
Angle brackets, double quotes, single quotes, forward slashes, backward slashes and colons all pass through with no filter.
I don't really know how to utilize the
<script>alert;throw 1;<script> I've seen used before, as it doesn't seem to execute anything, and even if it did, the space can't be used.