I have made an ASP.NET (fw 3.5) site and wanted to check if it is vulnerable.
I accept input from a textbox and save it in the database and then display it later on another page dynamically.
If i try to enter <script>...</script>, or anything with < and > for that matter, my global.asax catches the exception and I get the message A potentially dangerous Request.Form value was detected from the client (TextBox1="<b>
asd</b>
").
I then tried this: <script>$(window).load(function(){alert('hello');});</script> and this got inserted in the db same way but renders on the page as <script>$(window).load(function(){alert('hello');});</script>.
I do not, however, get an alert box. The script gets printed as it is on the page. The HTML rendered is:
<td style="font-size: 16px;" colspan="2"><script>$(window).load(function(){alert('hello');});</script></td>
My question is, why is this script not executing? I mean, it is a great thing, as I was reading about cross side scripting attacks and wanted to make my site secure, and that is how it is behaving now, but I don't understand why it is not as I really haven't coded anything to stop such attacks.
Thanks in advance.
<script>$(window).load(function(){alert('hello');});</script>and it's the browser showing it decoded. How did you view the source of the page?&ltscript&gt$(window).load(function(){alert('did this work?');});&lt/script&gtYou were right, it is being HTML encoded..