I came across this link today that does run XSS on the site it was originally intended for:
I tried this on my site, which has request filtering configured to 404 on
onerror but this URL was allowed.
I added # to deny rules and I also added it as a deny sequence in the QueryStrings tab, but it was still allowed. Presumably because # is special and anything after it doesn't count as URL or Querystring.
Is it wise to block # if our site(s) don't need it and if so, how can I deny # on IIS7?