Bypassing Angle Bracket XSS Filter

TL;DR

Angle bracket filters block basic HTML tags like . We can bypass this by using alternative encoding, case mixing, or injecting HTML entities to reconstruct the tag.

Solution Guide

1. Understand the Filter: The filter likely looks for literal angle brackets (< and >) in user input. It aims to prevent direct injection of HTML tags.
2. Alternative Encoding (HTML Entities): Replace angle brackets with their corresponding HTML entities:
   • < represents <
   • > represents >

   Try injecting: . The browser should interpret this as a script tag.

3. Case Mixing: Some filters are case-sensitive. Try variations like:
   • ≪
   • &lT;
4. Double Encoding: If the server decodes HTML entities multiple times, double encoding can help. For example:
   • Encode to <script>alert(1)</script>
5. Using Character Codes: Use the decimal or hexadecimal character codes for angle brackets:
   • Decimal:
   • Hexadecimal:
6. Tag Attributes: Inject JavaScript into tag attributes. This often bypasses filters focused on the main tag structure.
7. Context Matters: Where is the input being used? If it’s inside an attribute, you might need to use single quotes instead of double quotes:
8. URL Encoding: If the input is URL encoded, try encoding the payload accordingly.
9. Nested Tags: Sometimes nesting tags can work:
10. Browser Variations: Different browsers handle XSS payloads differently. Test your exploits in multiple browsers (Chrome, Firefox, Safari, Edge).

Remember to always test responsibly and only on systems you have permission to assess.