I'm testing a project I'm working on. Here I've put a filter on server side(Java) to redirect the page to Error page whenever I encounter any HTML tag like regex(URL Encoded is also checked) in query string. As per my skill set, it's working fine. But I'm very much sure it's not the end. There must be a way to still enter the vector to execute XSS script.
Examples : <hello> redirects to error page
%3Chello%3E
converts to <hello> and redirected to error page
%253Chello%253E
converts to %3Chello%3E
& page works fine as no HTML tag is found.
Aucun commentaire:
Enregistrer un commentaire