I am trying to do a bypass on a page for an XSS but I can not, I would appreciate it. The scenario is as follows: The page displays the following:
When trying to put any xss, I appear for example: your research: ScriPtALeRti am here/scriPt had 0 results
I tried to evade it, because it shows that it recognizes the "<>" and so I put the following:
However, nothing is displayed. In the console of the page, I see the following:
web.faq.Faqs.PortalFaqsController?axn=search&txtSearch=<svg><a><rect%20width=100%%20height=100%>:310 A Parser-blocking, cross site (i.e. different eTLD+1) script, http://www.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message.See https://www.chromestatus.com/feature/5718547946799104 for more details.*
If I click on where this is generated, I get the following, which shows that it uses 'unescape':
Thanks for your help.