XSS filter bypass

On this post, i want to introduce the tips to bypass XSS filter. Cross Site Scripting (XSS) is a Web application attack in the data output to the page when there is a problem, leading to an attacker can be constructed malicious data displayed in the page vulnerability. Because the cross-site scripting attacks are to the page content to write a malicious script or HTML code, so cross-site. Last active 9 days ago. Star 358. Fork 129. Star. Code Revisions 4 Stars 358 Forks 129. Download ZIP. XSS Filter Bypass List. Raw. xxsfilterbypass.lst XSS: Arithmetic Operators & Optional Chaining To Bypass Filters & Sanitization Using JavaScript Arithmetic Operators and Optional Chaining to bypass input validation, sanitization and HTML Entity Encoding when injection occurs in the JavaScript context Bypassing Signature-Based XSS Filters: Modifying HTML In many cases, you may find that signature-based filters can be defeated simply by switching to a different, lesser-known method of executing script. If this fails, you need to look at ways of obfuscating your attack The two primary methods of avoiding Cross-site Scripting (XSS) vulnerabilities are XSS filtering and XSS escaping. However, XSS filtering is not recommended because it can usually be evaded using clever tricks. Here are some of the methods that an attacker can employ in their malicious code to easily bypass the XSS filters in your web application

For eg: if you put the <scirpt>alert(hi)</script> , the Filter will escape the (quote) character , so the script will become <script>alert(>xss detected<)</script> Now this script won't work. Likewise Filters use different type of filtering method to give protection against the XSS. In this case, we can use some tricks to bypass the filter XSS filter evasion refers to a variety of methods used by attackers to bypass Cross-Site Scripting filters. Attackers attempting to inject malicious JavaScript into web page code must not only exploit an application vulnerability, but also evade input validation and fool complex browser filters

Everythings do to bypass XSS filter • Penetration Testin

[XSS] Reflected XSS Bypass Filter. Mohamed Sayed. Follow. Apr 22, 2019 · 2 min read. I would like to write about this but it takes some time to bypass the filter and some time to find the right HTML tag to write a payload The XSS-Filter in IE8 can sure be beaten. It depends on the XSS-Vuln in the page whether it's possible or not. For example you can use weird encodings or a double XSS attack. Edit: This is an in-the-wild example of an XSS-Attack that would pass the IE8-Filter: XSS on esrb.org. Ie basic XSS filter processes the outgoing request by first checking. The bypass was done by abusing the browser's XSS filter. This is quite ironical, because both XSS filter and CSP are designed to protect users from XSS attacks, but this vulnerability allows attackers to abuse one XSS protection mechanism to bypass another. XSS filter was first introduced in IE 8 If not, a simple filter bypass is possible, by submitting your own backslash at the point where the application inserts a backslash. The first backslash escapes the second, so that the following character remains unescaped.

##### #Title : XSS, how to bypass filters # #Author : k3nz0 # #Contact : o9p@hotmail.fr # #Category : Papers # #Website : k3nz0.com # ##### #####Tunisian##### #####Hacker##### ##### This lessons is devided into 3 parts : [1] Introduction [2] Types of filters [3] Conclusion [1] Introduction : Nowadays, most of securised websites, make filters to don't allow cross site scripting injections. scripting (XSS), SQL injection (SQLI), and other common web-application related vulnerabilities. In my tests, I focused on finding methods to bypass WAFs protection against cross-site scripting vulnerabilities. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injecte Intro If you ever tried to XSS something using the Google Chrome browser you have noticed that it usually doesn't work. This is due to a native filter named XSS Auditor. Over the years, this built-in feature has evolved and get stronger with several bypasses found by the infosec (information security) community. But it has Continue reading Chrome XSS Bypass Bypassing ASP .NET ValidateRequest for Stored XSS Attack. This article introduces script injection payloads that bypass ASP .NET ValidateRequest filter and also details the hit and trial procedures to analyze .NET debug errors. The techniques included in this article should be used when ValidateRequest is enabled, which is the default. HTML encoding is a one-way application filters the bad payloads and sanitize to prevent XSS. In this episode, we have discussed common filters, their mechani..

XSS Filter Bypass List · GitHu

Most times injection points are in the quoted strings. Filter uses backslash to escape such dangerous character. In this episode we have seen what are differ.. has an XSS filter, and it doesn't have the assumption of Trusted XSS. In order to preserve compatibility IE could allow a trusted subset of HTML to be set via HTTP request. The HTML Purifier[7] project is an HTML filter that does this. HTML Purifier has has security problems[8] and this approach has its own hazards Sucuri XSS Filter Let's get to the main topic, In this post i would be revealing one of the many bypasses i found for sucuri's XSS filter. The full bypass works with user interaction, however given that you follow the given methodology you would easily be able to construct a bypass that does not require user interaction CSRF + XSS (filter bypass) A CSRF is operated through an XSS. In this case we rely on a TJCTF challenge but it is applicable in many areas. This kind of attacks show the danger that XSS have as we saw in the post from WordPress 5.1 CSRF + XSS + RCE - Poc where even RCE was achieved How to bypass XSS filters Here is a check-list based on my experience: Enumerate all cases of reflection for the string you injected in the webpage. Some cases will be easy to leverage (inside a script tag), some hard (between two tags) Determine which characters you will necessarily use. If you can't inject a HTML tag because < is replaced or.

XSS Filter Bypass - How to do it. Bug hunter, I'm pretty confident of your awareness on the mechanics of the XSS filter of IE/Edge, but just in case, remember that it is literally disabled on pages where the referer host equals the host of the rendered page Bypass XSS filters using data URIs. By balaji. October 16, 2010. Data URI, defined by RFC 2397, is a smart way of embedding small files in line in HTML documents. Instead of linking to a file stored locally on the server, the file is provided within the URL itself as a base64-encoded string of data preceded by a mime-type Bypass Uppercase filters like a PRO (XSS Advanced Methods) a code injection inside javascript code can be a headache. But nothing is impossible. While we are not working on Pentesting for companies, we love to Bug Hunting on Hackerone. We founded a vulnerable section on a site, with some sort of google analytics code, vulnerable to a URL XSS In this circumstance, I would like to see a filtering bypass through HEX Encoding. 1. What is HEX Encoding? HEX encoding is a way to represent hex data on the web via string & # x. It is called hex encoding to make it comfortable. 2. Insert simple XSS filter and general XSS syntax The principle is simple. If you append 41 & # x to the hex. Bypassing browser anti-xss filters Unfortunately, Firefox, Chrome, and Internet Explorer have implemented some techniques for preventing reflected xss attacks. These techniques look at the string passed as a parameter in the url, and filter out anything that looks malicious (like any input wrapped in <script> tags, or the word Javascript.

XSS: Bypass Filters & Sanitization - Secjuic

This post intends to serve as a list of simple bypass techniques to try when attempting to inject XSS payloads. Tweaking the case of your script tags. Some filters are case sensitive and will not remove the script tag if there are uppercase characters. Example: <sCript> alert ('xss') </sCRIpt>. Placing Script tags within script tags XSS - Cross Site Scripting - [part 2 - Bypass Filters] Đăng vào 29 Th7 2019. 31 Th7 2019 bởi Dr.X. Ở phần 1, tôi đã giới thiệu một số kiến thức cơ bản về XSS. Trên thực tế, các dev thường sẽ áp dụng các bộ lọc (filter) hoặc chuẩn hóa input (sanitize) để ngăn chặn XSS attack. Tôi. Basic XSS Filter Bypasses. Sometimes, you will run into a situation where there is some kind of filter that is stopping you from being able to insert your payloads. These filters vary in strength - a poor filter is easy to bypass while more mature filters are more difficult, or impossible OWASP: XSS Filter Evasion Cheat Sheet XSS without HTML: Client-Side Template Injection with AngularJS by Gareth Heyes James Kettle CSP 2015 by filedescriptor Bypassing ASP.NET ValidateRequest for stored XSS attack by InfoSecAuditor XSS Auditor bypass / Another one by Gareth Heyes X-XSS-Nightmare: XSS Attacks Exploiting XSS Filter (IE/Edge) by. URL Schema filter bypasses. Let's say you've got an opportunity to inject data into something that touches the URL. Like a location.href, but it's filtered. This is a list of things you can attempt to to do bypass it. Credit for this particular set of hackery goes to this great article on XSS in Django (Some of these are browser dependent

Bypassing Signature-Based XSS Filters: Modifying HTML

The main idea of bypassing a packet filter as well as anti-XSS browser filters is to craft requests semantically equivalent to an XSS attack, while avoiding the security policies. For XSS, we usually don't want to use common JavaScript methods to steal user information, such as: document.write(), document.cookie(), alert(), etc XSS Filter Bypass List with indexes. GitHub Gist: instantly share code, notes, and snippets

XSS Filter Evasion Basics Acuneti

Aditional: (filterbypass)XSS Filter Bypass. A PTC Technical Support Account Manager (TSAM) is your company's personal advocate for leveraging the breadth and depth of PTC's Global Support System, ensuring that your critical issues receive the appropriate attention quickly and accurately The multi-line comments mean nothing to the HTML but mean the world when they are placed in a script environment In summary, all you need to bypass the XSS filter is to have at least two variables under your control, and break up your injected script, with the help of multi-line comments, to use both. P.S Imperva WAF Bypass. This is a story about an XSS vulnerability on a website for a popular UK restaurant chain which from this point forward I will simply refer to as Shenanigan's. The interesting thing is not, in fact, the XSS vulnerability but is about bypassing the Web Application Firewall that was protecting it How to create a good XSS filter to block most XSS vectors. Before we start creating a XSS filter, I want to say one important thing: We can never claim to have a perfect XSS filter. Researchers always find weird ways to bypass filters. But we can try to make a filter that can filter easy and well-known XSS vectors

• detects all forms of XSS imaginable (and more) • Each injection is given a score based upon the number of filters triggered • Filters have greatly improved over past 2 years thanks to demo.phpids.org, sla.ckers, and Mario who frequently updates PHP-ID CSP Bypass Guidelines. March 8, 2021. March 8, 2021. Brute The Art of XSS Payload Building. Content Security Policy (CSP) is the last line of defense against the exploitation of a XSS vulnerability. When correctly implemented, it seems to be extremely effective in doing so (nowadays). Here we will deal with the possible ways to abuse flaws in. Bypass XSS Filters. Reflected cross-site scripting attacks are prevented as the web application sanitizes input, a web application firewall blocks malicious input, or by mechanisms embedded in modern web browsers. The tester must test for vulnerabilities assuming that web browsers will not prevent the attack. Browsers may be out of date, or. The bypass was done by abusing the browser's XSS filter. Both XSS filter and CSP are designed to protect users from XSS attacks, however this vulnerability allows attackers to abuse one XSS protection mechanism in order to bypass another. XSS filter was first introduced in Internet Explorer 8

XSS 403 forbidden bypass write up. Nur A Alam Dipu. Apr 24, 2018 · 3 min read. Hello, This is my second blog post and first write up about xss. I think there is no new things here that you. Browser's XSS Filter Bypass Cheat Sheet. Awesome Open Source. Awesome Open Source. Filterbypass. Browser's XSS Filter Bypass Cheat Sheet. Stars. 916. License. Open Issues. 1. Most Recent Commit. 4 years ago. Related Projects. security (1,934)pentest (214)cheatsheet (198)xss (99) Repo There's a problem with the reflective Cross Site Scripting (XSS) filter in Microsoft's Internet Explorer family of browsers that extends from version 8.0 (where the filter first debuted) through the most current version, 11.0, released in mid-October for Windows 8.1, and early November for Windows 7 Cross Site Scripting (XSS) filters Cross Site Scripting (XSS) is a computer security vulnerability typically found in web applications. It enables attackers to bypass client-side security mechanisms normally imposed on web content by modern web browsers by injecting malicious script into web pages viewed by other users

How to bypass xss filters - Ethical Hacking Tutorial

  1. You can disable XSS filter to stop script errors. But if that does not work, then you can try out the rest of the methods. Let's try out these methods. Method 1: Follow these steps to disable XSS filter. a. Open Internet Explorer and click on Tools. b. Click on Internet Options and then select Security tab. c. Click on Custom level
  2. This blog article should give you some insights about the vulnerability, because it's not only a simple XSS, but a rather nice XSS filter bypass. But before digging into PHP stuff, I'd like to outline the really great work by the TYPO3 security team!!11 This was definitely one of the best and most efficient coordinations I have ever done
  3. The most well-known is XSS Filter Evasion Cheat Sheet, which was produced by RSnake and then donated to OWASP. </script> This could be a bypass! If the filter runs recursive tests, you should always check to see if it is still exploitable. Changing the sequence of the inserted strings can help you. Let's look at an example
  4. 66585 - XSS filter bypass via document.write (location.href) and fragments. Bug 66585 - XSS filter bypass via document.write (location.href) and fragments. Summary: XSS filter bypass via document.write (location.href) and fragments. Status
  5. Laravel 4.1. It relies upon a blacklist approach to filter out common. malicious inputs. *=========*. *Vulnerability*. *==========*. The vulnerability lies in the fact that the XSS filter was decoding HTML. entities, therefore based upon this fact it was. possible to construct a payload that would successfully bypass the
  6. XSS is a type of injection attack in website. In this post I will show you how to exploit Reflected XSS in DVWA web app at low, med and high level security. Let's try to bypass the the filter. After analysing the source code we found that our <script> tag is filtered

XSS Filter Evasion Netsparke

  1. This XSS may bypass many content filters but only works if the host transmits in US-ASCII encoding, or if you set the encoding yourself. This is more useful against web application firewall cross site scripting evasion than it is server side filter evasion. Apache Tomcat is the only known server that transmits in US-ASCII encoding
  2. If you want to learn more about XSS Mitigations, Code-reuse attacks and learn how hackers attack your environment, check out his 3 days training: Secure Web Development and Hacking for Developers. Tags code-reuse attacks , cross-site scripting , CSP bypass , script gadgets , XSS mitigation bypass
  3. penetration testing hybrid (28538) sql injection (7561) xss (3316) bypass (2278) useful tool (1745) xss payload (1107) waf bypass (804) clickjacking (687) sensitive info leak (574) api (571) Menu Disclaime
  4. XSS - Stored - contournement de filtres 31 May 2021 at 15:29: Mayus XSS - Stored - contournement de filtres 27 May 2021 at 11:28: yehuju XSS - Stored - filter bypass 27 May 2021 at 05:42: Spinozaure XSS - Stored - contournement de filtres 27 May 2021 at 00:27: LightDiscord XSS - Stored - contournement de filtres 24 May 2021 at 20:34: PPF
  5. From Adobe AEM dispatcher filter rules bypass to successfully triggering XSS on 40+ Linkedin websites [ Youtube Video ] From : Ateek khan <ateek.khan () gmail com> Date : Sun, 14 Mar 2021 15:50:22 +050
  6. Searching around online, I came across CodeIgniter <= 2.1.1 xss_clean() Cross Site Scripting filter bypass, written by @kkotowicz, which provided me with more working bypasses. Workaround. If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package

A Trick to Bypass an XSS Filter and Execute JavaScript


Unicode encoding-based filter evasions have been around for years and we thought web developers would write filters to cover it all. However, it seems that is not true. The new round has come with Arian Evans and Jeremiah Grossman testing a unicode-encoded left (%u00AB) and right (%u00BB) angle quotation mark for getting around XSS filters Testing the XSS filter needs three steps to be performed before landing in the reflection page. Since the injection is reflected within a P HTML element, the tool will reverse the filter and report the allowed tags and attributes in the final report. Obviously, detected XSS are reported as well

Video: How Hackers Can Easily Bypass XSS Filters In Web

An attacker could craft something similar to a common reflective XSS attack to bypass the filter, but would have to entice the user via a phishing email to land on a site hosting an exploit We will show you how we bypassed every XSS mitigation we tested. Content Security Policy WAFs whitelists nonces unsafe-eval strict-dynamic ModSecurity CRS 3 /16 4 /16 10 /16 13 /16 9 /16 Mitigation bypass-ability via script gadget chains in 16 popular libraries XSS Filters Sanitizers Chrome Edge NoScript DOMPurify Closure 13 /16 9 /16 9 /16 9. 'Internet Explorer 9 has a security system with well known shortfalls, most notably that it does not attempt to address DOM based XSS or Stored XSS. This security system is built on an arbitrary philosophy which only accounts for the most straight forward of reflective XSS attacks. This paper covers three attack patterns that undermine Internet Explorer's ability to prevent Reflective XSS.' Researcher Identifies XSS Filter Bypass in Microsoft Edge. Gareth Heyes, one of the security researchers working for PortSwigger, the company behind the famous Burp Suite security testing toolkit. Today, I want to share IE's XSS filter bypass with showModalDialog. showModalDialog function is old and has been removed from the web standards, but it has unique mechanism. I thought it might make my day. That's why I started looking into it. The function is still supported by IE, Firefox and Safari. First of all, let's recap usage of.

Vimeo: Application XSS filter function Bypass may allow Multiple stored XSS 2015-01-18T10:18:23. ID H1:44217 Type hackerone Reporter securityidiots Modified 2015-06-28T15:50:24. Description. Hi The vulnerability lies in the fact that the XSS filter was decoding HTML entities, therefore based upon this fact it was possible to construct a payload that would successfully bypass th There is a bug in the anti-cross site scripting filter in Chrome and Safari that enables an attacker to bypass the filter in some cases and use an XSS flaw on a given site to compromise visitors.

[XSS] Reflected XSS Bypass Filter - InfoSec Write-ups - Medium

GitHub - masatokinugawa/filterbypass: Browser's XSS Filter

  1. PHP code to bypass the XSS filter of WebKit (i. e., XSS . Auditor) and perform XSS attacks. In particular, the fi rst. attack is called PHP A rr ay I njection, while th e second attack
  2. I identified a form of malicious input that would bypass the xss_clean() filtering, allowing for arbitrary JavaScript to be executed. The vulnerability has been patched in CodeIgniter 2.1.4. Any developers relying on xss_clean() as a form of protection should upgrade their application to the latest version of the framework
  3. xss part 7(my challenge solution filter bypass) Join us on facebook for more tutorials and courses ———————————————-shell upload bypass source code validation 201
  4. XSS Filter Evasion Cheat Sheet, This cheat sheet lists a series of XSS attacks that can be used to bypass certain XSS defensive filters. Please note that input filtering is an incomplete defense for This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters
  5. The validator module for Node.js contains functionality meant to filter potential XSS attacks (a filter called xss). Several ways to bypass the filter were discovered. In general, because the function's filtering is blacklist-based it is likely that other bypasses will be discovered in the future
  6. In this paper, besides other things, they presented a very interesting way to bypass XSS filters using Unicode charcters. XSS filters. Consider the following piece of code: This code is using the utf8_decode function to decode the input to single-bytes characters. Later, it will check if the decoded input contains dangerous characters and.
  7. snuck is quite different from typical web security scanners, it basically tries to break a given XSS filter by specializing the injections in order to increase the success rate. The attack vectors are selected on the basis of the reflection context, that is the exact point where the injection falls in the reflection web page's DOM

WordFence WAF XSS Bypass - CVE-2019-9669 by Anthony Yalcin A Web Application Firewall (WAF) is an application firewall that filters, monitors, and blocks malicious HTTP traffic. By inspecting HTTP traffic, it can prevent attacks related to web application security flaws, such as SQL injection, cross-site scripting (XSS), and security. XSS Filter Evasion Challenge 1. Difficulty: Moderate. Recently, while working on some private bug bounty programs, I ran into similar cross-site scripting (XSS) filters. These filters triggered on !#$ ()*;<>| and new line characters. When triggered, these filters would replace the entire user input string with an empty string The two other browsers who featured an XSS filter besides Chrome were Internet Explorer and Edge. Microsoft removed the XSS filter from Edge last year. The OS and browser maker cited the presence.

web application - XSS filter bypass < and/or

3. Scroll down to the Enable XSS Filter option under the Scripting section. (see screenshot below) 4. To Turn On the XSS Filter in IE8 or IE9. NOTE: This is the default setting. A) Select (dot) Enable under Enable XSS Filter, and click on OK. (see screenshot below step 3) B) Go to step 6. 5. To Turn Off the XSS Filter in IE8 or IE9 Well this is a continuation of my previous blog on XSS (Cross-Site Scripting) - Overview and Contexts and this time I will continue with attack methodology and solutions. Actually if we think closely we can realize that each attack should have a methodology through which an attacker try to bypass a context or any filter CodeIgniter <= 2.1.1 xss_clean () Cross Site Scripting filter bypass. This is a security advisory for popular PHP framework - CodeIgniter. I've found several bypasses in xss sanitization functions in the framework. These were responsibly disclosed to the vendor and are now fixed in version 2.1.2. (CVE-2012-1915) Problem #3. The response only contains part of the payload, for example ><script>alert(0)</script> only returns ><script>. What to try. First things first, we know they don't filter XSS here, however this can be quite tricky to bypass as it all depends on where it is returned and if you can control anything else detected, the XSS Filter searches evidence of reflection. If reflection is detected, the XSS Filter sanitizes the original request so that the additional JavaScript cannot be executed. However, the XSS filter can by bypassed with leading regexp inside svg script tag. Details Title: Google Chrome Anti-XSS Filter Bypass

Bypass XSS filter - Stack Overflo

JSON based XSS. Koumudi Garikipati. Jun 18, 2020 · 5 min read. Basically Cross-Site scripting is injecting the malicious code into the websites on the client-side. This vulnerability normally allows an attacker to masquerade as a victim user, to carry out any actions that the user is able to perform and access any of the user's data XSS cheatsheet Esp: for filter evasion By RSnake Note from the author: If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS but want a deep understanding of the nuances regarding filter evasion Bypass XSS filters at Tiki. January 9, 2016 By sangbui 0 comments. Sau khi nhận được email thông báo lỗi XSS của tôi, Tiki có sửa lỗi nhưng hiện tại lỗi XSS trên Tiki vẫn có thể vượt qua bộ lọc để khai thác tiếp. Đây là chi tiết cách tôi đã Bypass XSS filters trên Tiki Chrome's development team has decided to retire the XSS Auditor, its inbuilt Cross-Site-Scripting (XSS) filter that aimed to prevent reflected Cross Site Scripting vulnerabilities in the majority of cases. While this move might surprise many observers, it follows a long list of bypasses, security related side effects and false positives that.

Cross-Site Scripting (XSS) is a security vulnerability which enables an attacker to place client side scripts (usually JavaScript) into web pages. When other users load affected pages the attacker's scripts will run, enabling the attacker to steal cookies and session tokens, change the contents of the web page through DOM manipulation or. Have you ever found an XSS that be limited to only 30 characters? Oh, surely sometimes. How could you get around it? Today, I will talk about a highly effective technique to beat length limit filter of XSS. It is converting reflected XSS to DOM-based XSS. For example, you can find this payload in other blogs: <script>eval(location.hash.slice(1. Overview. express-validator is an express.js middleware for validator.js.. Affected versions of this package are vulnerable to Filter Bypass. express-validator by default does not sanitize arrays or non-string values. This vulnerability could be leveraged by an attacker to bypass express-validator protections and inject malicious JavaScript into a webpage

XSS Filter Bypass - Learn Hacking and Pentestin

The payloads are designed to bypass incomplete filtering (e.g., incomplete HTML encoding etc.) and tries many variations of characters injection that would enable the XSS payload. They record all the responses from the server that include unmodified versions of their script Filter Bypass Runtime Log Technical Support. Sign up! More info about the tool here. Some testimonials from users here. Full XSS Coverage here. Full refund up to 30 days, no questions asked. Automatic 10% OFF for subscription renewals. NOTICE: all plans refer to a service provided as it is and still in BETA phase XSS in Unexploitable tags (input hidden, link, canonical) From here: You can execute an XSS payload inside a hidden attribute, provided you can persuade the victim into pressing the key combination. On Firefox Windows/Linux the key combination is ALT+SHIFT+X and on OS X it is CTRL+ALT+X XSS Filter in Laravel Framework. Feb 11, 2013 · 3 min read If you are connected with the PHP development world then you must have heard the name Laravel and you know what it is. If you don't know, Laravel is a modern PHP framework which utilizes modern PHP features and uses some of the existing frameworks' components to truly awesomify PHP.

[XSS] Reflected XSS Bypass Filter by Mohamed Sayed

XSS: Beating HTML Sanitizing Filters - PortSwigge

7 Reflected Cross-site Scripting (XSS) - Zuck rajputResearcher Identifies XSS Filter Bypass in Microsoft EdgeSvg Xss Auditor Bypass - SVGIMreflected xss - How to bypass server side XSS filter for