Home/ Questions/Q 8604097
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T02:29:08+00:00

In this article, I’m warned of an XSS attack vector %u00ABscript%u00BB . I’m wondering

  • 0

In this article, I’m warned of an XSS attack vector "%u00ABscript%u00BB". I’m wondering what type of syntax "%u00AB" is. In my brief tests on Chromium, it doesn’t actually get rendered into a tag, leading me to believe that the syntax is used by either an SQL engine, or a server side programming language. I’m not concerned with stored/reflected XSS, only DOM-based ones. I don’t recognize it though, so maybe its like ruby or python or something?

Also, does anyone know if its an issue in other browsers? I only tested Chromium, but perhaps other versions and browsers behave differently and are therefore vulnerable.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is a kind of Percent-encoding mechanism know as non-standard unicode, or %u encoding, was rejected in 2004.

    In short, you should by aware of all the possible combinations of the character "<". The best start point is OWASP XSS Filter Evasion Cheat Sheet.

    • 0