Bypassing HTML Entities

[1100]

Is it possible? For example, whenever I input the character ">" out comes > in it's place. Any way to exploit this?

[Scrapheap]

The usual way to exploit <>'s is when the system doesn't replace them with &lt; and &gt; as you can then insert your own html tags and script tags.

[1100]

Well yeah but I was wondering if that was possible to bypass ( the translation of < to &lt; and > to &gt; )

Also, I was once part of a forum that made HTML comments for every thread name and post body. It was ridiculous. All you had to do was type "-->" and then inject any HTML code you wanted, and of course CSS and Javascript if you wanted. Haha just thought I'd share that.

Example:
thread name was "--> <style type="text/css"> blah blah <!--"

<!-- thread name -->

<!-- --> <style type="text/css"> blah blah <!-- -->

[Scrapheap]

You try using url encoding of a unicode value which can sometimes get through to the browser.

[1100]

Hmm. I'm assuming that doesn't really work much nowadays, though. Right? Thanks for the suggestion!

[Scrapheap]

It doesn't work so much these days, but it's always worth trying just to be sure.

[1100]

Thanks again, buddy!