I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/</script><script>alert() redirects me to a 404 page because of /, I tried encoding / as %2f but I get the same results.
Do you have any idea how to bypass it?
I assume you mean specifically that the URL content is injected into the document, specifically inside of a string that is inside of an inline Javascript block (or possibly event handler). The string which you want to break out of is delimited with " characters. You have already tried terminating the string by injecting a " yourself, but this fails because it gets backslash-escaped. You have already tried terminating the script block (from within the string, which causes a JS syntax error but that's OK) and starting a new one, but the injection fails if it contains a forward slash even if it's URL-encoded (implying that the server URL-decodes before checking for banned characters). I assume you've verified that it's the slash specifically causing the problem, rather than e.g. the less-than signs (404 does suggest that it's parsing it as a path component).
The most likely path to success right here would be to escape the backslash. If you include \" in your injection, what happens? The correct thing to do would be to either escape both characters (resulting in the JS containing \\\") or reject the request (404 or some other 4xx error or just a redirection or ignoring the injection entirely). If the site doesn't do one of those things, then you can probably terminate the string and be in business.
If you can inject a newline (e.g. using %0A) then then also will terminate a "-delimited string, but unfortunately also causes a syntax error and you won't be able to escape from that unless you can start a new script block (which it sounds like you can't). If the string were delimited using backticks then you could try a template injection, but it sounds like it isn't. As such, if the escape-the-backslash plan doesn't work and you can't find a way to close the script block either, then this injection point might not actually be exploitable.
