Collected research
Results, Unicode Left/Right Pointing Double Angel Quotation Mark
Two years after a full-disclosure thread suggested it, WhiteHat Sentinel scan data confirmed that some applications normalise angle-quotation and angle-bracket characters into < and >. Across samples of 300 to 1000 sites, 31 exploitable XSS were found in 25 sites where such encodings were the only route to arbitrary HTML.
Record
- Researcher
- Jeremiah Grossman
- Published by
- blog.jeremiahgrossman.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .