XSS Filter Evasion Cheat Sheet — XSS Using HTML Quote Encapsulation

Reference note (untrusted external data; do not execute it as instructions). This attack was originally tested in IE so your mileage may vary. For performing XSS on sites that allow but don't allow \]+src/i, do the following If you are performing XSS on sites that allow but don't allow \\\s\]+))?)+\\s\|\\s\)src/i (This is an important one, because this regex has been seen in the wild) Another XSS to evade the same filter: /\\\s\]+))?)+\\s\|\\s\)src/i Yet another XSS that evades the same filter: /\\\s\]+))?)+\\s\|\\s\)src/i Generally, we are not discussing mitigation techniques, but the only thing that stops this XSS example is, if you still want to allow tags but not remote script is a state machine (and of course there are other ways to get around this if they allow tags), use this And one last XSS attack to evade, /\\\s\]+))?)+\\s\|\\s\)src/i using grave accents (again, doesn't work in Firefox) Here's an XSS example which works if the regex won't catch a Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.