13
<iframe src=file:///etc/passwd></iframe>
This displays a local file in the browser inside a separate iframe. This iframe has a different origin than the main frame. Due to same origin policy it is not possible to read the iframe content from the main frame, no matter if XSS or not.
2
There is no default way/trick to bypass this.
However you can try to identify if there is a regex in place that you can break.
Or if there are any normalization/decoding inconsistencies.
Some ideas:
Check if the encoding happens recursively.
if you provide multiple '<', will they all be encoded?
Try different types of encoding (e.g. url encoding, double ...
1
I think it is something to do with browser's HTML validating technique. Browser is trying to close missing tags.
Do browsers automatically insert missing HTML tags?
Like in first case adding missing closing tag of HTML comment, and converts whole document as comment. But why it is doing differently in first and second case. I think that's why it is said that ...
Only top voted, non community-wiki answers of a minimum length are eligible
