.Net has a feature called request validation which detects malicious inputs and blocks the request.
By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on request validation as defence-in-depth, not as a security boundary.
I am updating a .net security training course, and I like to include an example of why you should not rely on request validation. Sure, I could tell the trainees "don't do it" - but an example is very powerful.
I have found that request validation in .Net 4.5 has been tightened, and my previous methods of bypassing it no longer work. Are there any publicly known ways to bypass .Net 4.5 request validation, for XSS? The most recent link I found was this.