During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0- 9\%]+" in analyzed evidence details. What is the expression used for?

The correct answer is B. Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent. In XSS detection signatures, attackers encode special characters to evade filters. The forward slash (/) used in HTML closing tags (e.g., </script>) can be represented as its hex equivalent %2F or double-encoded as %252F. The pattern [a-zA-Z0-9\%]+ matches the alphanumeric charac

Submitted by omar99· Apr 18, 2026Network Forensics

Question

During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0- 9%]+" in analyzed evidence details. What is the expression used for?

Options

AChecks for upper and lower-case alphanumeric string inside the tag, or its hex representation
BChecks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
CChecks for opening angle bracket, its hex or double-encoded hex equivalent
DChecks for closing angle bracket, hex or double-encoded hex equivalent

How the community answered

(62 responses)

A
10% (6)
B
63% (39)
C
5% (3)
D
23% (14)

Explanation

In XSS detection signatures, attackers encode special characters to evade filters. The forward slash (/) used in HTML closing tags (e.g., </script>) can be represented as its hex equivalent %2F or double-encoded as %252F. The pattern [a-zA-Z0-9%]+ matches the alphanumeric characters and percent signs that make up these encoded forms, allowing detection of obfuscated forward slashes. Each character class in such XSS detection patterns targets a specific encoded artifact - this one targets the slash and its encoded variants.

Topics

#XSS Attack#Regular Expressions#URL Encoding#Forensic Analysis

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice