PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identifying and Remediating CWE-79: Cross-Site Scripting in ASP.NET

hackerone.com | vulnerability | #web-security | #xss | #owasp | #input-validation | #asp-net | #cwe-79 | #output-encoding
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to find and fix CWE-79 XSS in ASP.NET: enforce server-side input validation and output encoding with HttpUtility.HtmlEncode, enable ValidateRequest, and test with OWASP ZAP or Burp Suite.
Published
Collected

Related coverage

blog · portswigger.net
Null byte attacks are alive and well
Null bytes still bypass validation because native code ends strings at the first zero byte while managed code does not: Java's .jpg filename check falls to %00, while ASP.NET rejects embedded nulls.
vulnerability · hackerone.com
Preventing Directory Traversal Attacks: Techniques and Tips for Secure File Access
HackerOne explains how directory traversal via ../ sequences reaches files outside the web root, and walks through mitigations: strict validation, allow lists, and framework protections.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · bishopfox.com
What Is XSS?: An Overview
An explainer on cross-site scripting: how XSS runs attacker code in victims' browsers, the reflected, stored, and DOM-based varieties, and why contextual output encoding is the core defense.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · yeswehack.com
DOJO CHALLENGE #20 Winners!
Winners of DOJO Challenge #20 'Butters Adventure', which required exploiting a DOM-based XSS via the $cmd parameter. Best write-ups: Tihmz, bosstester and Braxoia.
Back