bumping into asp.net websites.
the default request validation seems to be impossible to bypass.
but i'm wondering why in most article, they asked the programmer not to rely on the default validation request.
it blocked all my attempt to inject anything useful.
so far there's only 1 case that i can succeed which is when the value is within an attribute. ( eg inside input/textbox)
but its pretty useless because in the admin page it will be display out of the attribute.
i tried a few way using unicode < or other encoding < but it seems like the database is configured to use nvarchar instead of varchar.
what else could i try ? i pretty much read everything i can in google results.
i kept come across article that asked developer not to rely on it.
my target site does not sanitize the input and is relying on it completely.
but i still can't seem to find anyway to bypass.
any suggestion ?
the default request validation seems to be impossible to bypass.
but i'm wondering why in most article, they asked the programmer not to rely on the default validation request.
it blocked all my attempt to inject anything useful.
so far there's only 1 case that i can succeed which is when the value is within an attribute. ( eg inside input/textbox)
but its pretty useless because in the admin page it will be display out of the attribute.
i tried a few way using unicode < or other encoding < but it seems like the database is configured to use nvarchar instead of varchar.
what else could i try ? i pretty much read everything i can in google results.
i kept come across article that asked developer not to rely on it.
my target site does not sanitize the input and is relying on it completely.
but i still can't seem to find anyway to bypass.
any suggestion ?