Monday, May 20, 2024
Homepage · asp.net
 Popular · Latest · Hot · Upcoming
-2
rated 0 times [  2] [ 4]  / answers: 1 / hits: 36235  / 13 Years ago, sun, april 17, 2011, 12:00:00

I'm sure that the answer to this question is No, but I can't seem to find a way that simply transforming < and > to &lt; and &gt; doesn't completely block reflected and persistent XSS.



I'm not talking about CSRF.



If this doesn't block XSS, can you provide an example of how to bypass this defence?


More From » asp.net
 Answers
49

When using an untrusted string in an attribute (quoted with ) you need to escape as &quot.



Otherwise you could easily inject javascript. For example, <a href={{str}}> with str being, for example, onmouseover='something-evil'.


[#92678] Friday, April 15, 2011, 13 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
janettejordynm
Add To Favorites
Follow
Total Points: 550
Total Questions: 94
Total Answers: 98
Location: Senegal
Member since Fri, Aug 21, 2020
4 Years ago
janettejordynm questions
Tue, Nov 24, 20, 00:00, 4 Years ago
Thu, Jun 18, 20, 00:00, 4 Years ago
Sat, May 23, 20, 00:00, 4 Years ago
Mon, Apr 6, 20, 00:00, 4 Years ago
Tue, Feb 18, 20, 00:00, 4 Years ago
View All
;