Bypassing Signature-Based XSS Filters: Modifying HTML - Port Swigger
Summary: PortSwigger Research documents how signature-based XSS filters that match HTML components via regular expressions can be bypassed by altering case, using arbitrary tag names with event handlers, inserting NULL bytes, and substituting characters for whitespace between tag names and attributes. The article also shows attribute values obfuscated through quote and backtick delimiters, attribute reordering, and HTML encoding with decimal or hexadecimal formats, superfluous leading zeros, and omitted trailing semicolons, tested against DVWA and OWASP's Magical Code Injection Rainbow.
Key Takeaway: Every bypass listed relies on browsers tolerating deviations from the HTML specification that the filter's regular expressions do not account for, so a filter tuned to one browser's parsing behavior can still pass an exploit that executes in another.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026