First off im a n00b so go easy on me. I have found a message variable that I can change on a site I'm currently testing. I can get the following output on screen ＜script＞alert(1)＜/script＞ as text using this "http://examplesite.com/login.aspx?Msg=%uff1cscript%uff1ealert(1)%uff1c/script%uff1e". Yet I cant seem to escape to get it to actually run as a script. Its an ASP.net site.
From page source:
- Code: Select all
<span id="msg" class="message">＜script＞alert(1)＜/script＞</span>
Any help would be appreciated (tutorials, direct help etc) or is this just not possible. I tried , < " etc yet it just outputs them as text.