Since reflector is just detecting characters like ' " > < /, etc. I am thinking an injection like %3E then the server will detect < (although sometimes the server always convert this automatically, then there should be an option).
and also if the reflector injects %253E it will detect if the server decodes it as <.
< as <\u003e as <\x3e as << as <
take note that not only the different encodings of < should be implemented, the others should too. :)
Hi,
Since reflector is just detecting characters like
' " > < /
, etc. I am thinking an injection like%3E
then the server will detect<
(although sometimes the server always convert this automatically, then there should be an option).and also if the reflector injects
%253E
it will detect if the server decodes it as<
.<
as<
\u003e
as<
\x3e
as<
<
as<
take note that not only the different encodings of
<
should be implemented, the others should too. :)