Kali Linux Web Penetration Testing Cookbook - Second Edition

There's more...

There are so many ways to use capitalization, encoding, and many different HTML tags and events to trigger XSS vulnerabilities that it is almost impossible to create a comprehensive list of forbidden words or characters. A few other alternatives we had in this exercise are as follows:

• Use a different HTML tag, such as <img>, <video>, and <div>, and inject the code in its src parameter or its event handlers, such as onload, onerror, and onmouseover.
• Nest multiple script tags, for example, <scr<script>ipt>. So, if the <script> tag is deleted, another tag is formed as a result of its deletion.
• Try different encoding on the whole payload or certain parts of it; for example, we could have URL-encoded <script> ...