Hi,
Just to clarify, can you confirm you're running a tool to test for XSS on your site and see a JavaScript popup box. What tool are you running and on what web server?

The encoding looks strange, it's clearly not all ASCII-7 and eight-bit ASCII just shows garbage. Perhaps the tools is sending unicode and this is mangling the web server access logs.

Jim

ilovewadhwa,

I have no idea what encoding this is using (don't know much about the different character encodings), but each hex value is 128 bytes above the normal ASCII values. This is interesting because ASCII values range from values 0-127. Subtracting 128 from each encoded value and converting it to ASCII gives you:

'"><script>alert('XSS Test Successful')</script>

Which is a pretty standard XSS test string. Whatever encoding it is using, it's probably not supported by most Web applications, so unless you are using some special encoding it probably isn't working (it depends though).

Like jimbob said, it's not ASCII-7 or regular ASCII. Also doesn't appear to be UTF-8 or unicode. If you could tell us if this string actually produces a pop-up box, and if so, what type of Web application/database you are using, it would help.