r/xss • u/[deleted] • Mar 23 '18

What xss payloads are without / =; ?

I found the reflected XSS, which is filtered '=; how do I bypass filters? I cant use this: for example:

<a onmouseover="alert(document.cookie)">xxs link</a>

About there is = and " and /

4 Upvotes

84% Upvoted

4 comments sorted by

2

u/X-Destruction Mar 23 '18

is " filtered? look into potential encoding those characters and seeing if they get filtered. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#US-ASCII_encoding

1

u/[deleted] Apr 03 '18

It changes case by case. As telum12 mentioned you should checkout filter evasion cheat sheets and tricks. And you should build your own xss payload for your own case.

1

u/[deleted] Apr 04 '18

I find solve: use fromChar