I am having a ASP.Net Web Forms (upgraded to framework 4.0) application that has request validation on all pages. Someone attempting a script injection (entering something like <script>location.href=dangerurl;</script> into a textbox and submitting) will generate an exception as ASP.Net request validation fails for the input control.

On the pages where HTML editors are used (and page validation is OFF) the input content is sanitised using antixss library.

But when the site went for external review they pointed out that the these textboxes accept text like <% some text and that it is considered as having stored XSS risk. The <% character combination is forgiven by the ASP.Net request validator somehow.

I cannot see a way of mounting an attack using this characters <%. Is the external evaluators observation correct in saying there is an increased XSS risk and if so how to possibly create an XSS vector?


No, printing <% in an HTML context doesn't make it vulnerable to XSS.

For an XSS attack you need to allow a letter after the opening bracket, as has also been discussed here. Starting with <% alone, you cannot construct an HTML payload. That said, it's a little suspicious that the XSS filter didn't go the whole way and filtered opening brackets followed by any character.

(Possibly, the auditors are worried about other attack vectors via embedded ASP code blocks but that's not related to XSS at all.)


Its possible that XXS vector can be formed using different encoding methods.

example :


Here is more details on this:


  • While I agree with what you say, I don't see how this has anything to do with the original question. The question was about how <% could be used as a payload. – Anders Dec 15 '16 at 11:47

Your Answer

