I've been searching for XSS vulnerabilities in a friend's website (blackbox) and in one of the pages he takes your input and puts it inside a js script, window.location="[INPUT]";
I couldn't break the quotes because they are being replaced with "
and %22
stays %22
, But I can put a \
at the end of my input and it escapes the original quote (window.location="[INPUT]\";
) Which gives me an unterminated string but I can't influence any code after that so there's no XSS there, right? All I can basicly do is break the code and that's it
Edit:
--Some more info--
<
,>
,&
and"
are being replaced with<
,>
,&
and"
- the server checks if
INPUT
begins withhttp://
orhttps://
Things I've tried:
- Break the string with
</script>
=>
being replaced with</script>
(and fails) - Tried to break it with URL Encoded
</script>
(%3C%2Fscript%3E
) but it shows it as string (window.location = "http://test.com%3C%2Fscript%3E\";
) and the error is stillSyntaxError: unterminated string literal
window.location="javascript:alert(1)";
http://
orhttps://