Top 10 winner

Selecting Encoding Methods For XSS Filter Evasion

RSnake · ha.ckers.org · 3 November 2006

Where an application lets the user pick the response charset, a string that is inert under UTF-8 becomes an injection under US-ASCII. Demonstrated against josefsson.org's IDN converter by flipping only the charset parameter. The lesson is that user-selectable encoding turns an otherwise safe filter into a bypassable one.

Record

Researcher

RSnake

Published by

ha.ckers.org

Date

3 November 2006

Topic

XSS

In the archive

• Ranked #8 in the 2006 Top 10 Web Hacking Techniques

Tags

• xss
• filter-bypass
• charset
• encoding
• unicode
• sanitizer-bypass
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of RSnake, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.