Questions tagged [filter]
The filter tag has no usage guidance.
7
questions
1
vote
0
answers
108
views
How to use html encoded characters to perform XSS?
I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
- 11
0
votes
0
answers
40
views
XSS: bypassing html entity encoding of <,>,& characters [duplicate]
I am currently testing a webapplication that is sanitizing user input by html entity encoding special characters.
E.g. <script>alert(1)</script> becomes <script>alert(1)&...
0
votes
0
answers
235
views
Stopping a Subscription Bomb
Are there any methods for stopping a subscription bomb other than issuing a new email address? Creating gmail filters is only getting us so far as there are more emails coming in than we can keep up ...
- 21
2
votes
1
answer
1k
views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
- 153
1
vote
1
answer
321
views
Why does javascript not show an alert box? [closed]
I'm trying to insert javascript:alert(1) inside tag. There is some kind of filter for javascript, so I tried using javascrip%74:alert(1) and that url is accepted.
However when i click on it it ...
- 41
2
votes
1
answer
1k
views
Are unescaped backslashes dangerous in terms of XSS?
I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why?
I found a ...
- 23
5
votes
0
answers
1k
views
Disable php://filter globally or per php file
Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini:
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html
Clearly, ...
- 641