Hi I am trying to build a white list. I am using html agility pack to remove all tags I do not allow. however this only gets ride of these type of script tags
<script></script>
However apparently you can put javascript what seems to be all the attributes too (Can't understand why someone though that was a good idea)
http://ha.ckers.org/xss.html
<IMG SRC="javascript:alert('hi');">
<INPUT TYPE="IMAGE" SRC="javascript:alert('hi');">
<BODY BACKGROUND="javascript:alert('hi')">
<IMG LOWSRC="javascript:alert('hi')"
above is just a sample but the site goes into alot more. I know it is for XSS and I am not trying to build something to stop XSS...I would just use the one that comes with asp.net mvc.
However to me i ...
Go to the complete details ...