Hack Forums
How can I execute XSS by bypassing filters for "=","<script" and "javascript" ? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: How can I execute XSS by bypassing filters for "=","<script" and "javascript" ? (/showthread.php?tid=4932877)



How can I execute XSS by bypassing filters for "=","<script" and "javascript" ? - mr.cracker - Aug 2, 2015

I want to execute XSS.
but WAF filters ==>
Code:
Code
<script, javascript, =

my search terms are => p1=sachin&p2=dravid
output :
Code:
Code
<input type="text" value="sachin"/>
<input type="text" value="dravid"/>
if I give <script, javascript,= it suddenly redirect to Default Error page!

Below code doesn't give any error,
Code
<<!--mm-->script>alert(1);</script>
But in browser it doesn't execute as a <script> tag.

i can use any other charcters except <script, javascript, = .
I can inject HTML tagslike,
Code:
Code
"><marquee><H1>HACKED<H1><marquee>[b]<!--[/b]
But I wanna execute XSS.
Without above filtered terms how can I bypass the WAF ?