[WEB SECURITY] XSS filter Bypass
mon.ver85 at gmail.com
Wed May 30 04:23:50 EDT 2012
I'm no expert, but how about trying %C0%80 ('invalid 2 byte' UTF encoding
for Null)? Does that make any difference?
On Thu, May 24, 2012 at 12:16 PM, Appsec User <pentestguy.cs at gmail.com>wrote:
> I am probing for XSS in an application. Application has a filter which
> triggers if I put anything after less than sign '<' except space, %
> and >. So application accepts < character but only allows space, % and
> > after it. So e.g < script(note space in b/w) is allowed but <script
> will be rejected(no space). I have tested for various encoding also
> <%00script is allowed but it puts space between < and script and
> context. Any suggestions how can I by-pass this filter.
> The Web Security Mailing List
> WebSecurity RSS Feed
> Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA
> WASC on Twitter
> websecurity at lists.webappsec.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the websecurity