[Anarchist001]

I get an error message such as this:

A potentially dangerous Request.Form value

The page is encoded in utf-8.

It doesnt allow characters that begin with < and follow by any letter.

For example,

<s

[Cathal]

Lel. What is this magical dot.net you speak of? Not gonna spoonfeed you here, but try closing the field first.

[Anarchist001]

It is dot.net 4, webform, and mvc 4 behaves the same.

Some dot.net configuration prevents you from submitting input such as that <a, but it allows something like this < a..

I tried Utf-7 encoding, double encoding, nothing worked..
I think I need to replace the < with something else that would parse.

This :

&#37uff1cscript&#37uff1ealert(9);&#37uff1c/script&#37uff1e
(Unicode wide presentation)
doesnt work too
I tried for a few hours, I cant bypass it :(

I need a reflected solution for this :(, But a persistent solution can be good too

What field?
<script></script>
If it sees that, it throws an error.

<1 this is okay, <a this is not.

A search functionality presents it in html, not inside a tag..so I dont see a way in,

Is there a way around it?

[xXSehgalXx]

It is dot.net 4, webform, and mvc 4 behaves the same.

Some dot.net configuration prevents you from submitting input such as that <a, but it allows something like this < a..

I tried Utf-7 encoding, double encoding, nothing worked..
I think I need to replace the < with something else that would parse.

This :

&#37uff1cscript&#37uff1ealert(9);&#37uff1c/script&#37uff1e
(Unicode wide presentation)
doesnt work too
I tried for a few hours, I cant bypass it :(

I need a reflected solution for this :(, But a persistent solution can be good too

What field?
<script></script>
If it sees that, it throws an error.

<1 this is okay, <a this is not.

A search functionality presents it in html, not inside a tag..so I dont see a way in,

Is there a way around it?

Did you try event handlers? search

Code

"

or others and try to close the attributes.

Check page source. If you are still unable to do it, share your page here.

[Apple J4ck.]

Considering I understood what you meant I'm pretty sure the code will look like this :

so if you type <script> in that form it'll print 'Error' and cancel the query, it might be something else though, this is just an example.

[Anarchist001]

Did you try event handlers? search

Code

"

or others and try to close the attributes.

Check page source. If you are still unable to do it, share your page here.

I used to be a web developer. It would be one of the first things that I would try.

Nothing is being held inside a tag.

The solution in my opinion can only be:
Encode this tag < to something else

Am I wrong here ? or is there an alternative solution. I know there is a hack around it, but i dont know something that would work..

The page is encoded in utf-8.

It isnt a specific page. It is about the dot.net applications that I test. I am a penetration tester

Here is an article to how the code looks like
<code>http://www.misfitgeek.com/2010/02/trapping-intentional-cross-site-scripting-xss-attempts-in-asp-net/
</code>
I think that dot.net 2 is more vulnerable than dot.net 4 but I am not sure

[Wellwhatsgood?]

Try filter evasion techniques such as encoding your scripts. You can find pages with pre- evaded vectors.

[Gee4rce]

Dude you are overthinking the challenge of tesco.com
(https://hackforums.net/showthread.php?tid=3601534)

...there is no need to escape special chars if you look at the right place, but it seems that you are looking somewhere different?!

[Anarchist001]

I dont care about tescos.. I wanted to ask that question to bypass the dot.nets server validation mechanism