I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the
<script> tag. The script tag that I just mentioned has it's
src referring to another domain, called, visualwebsiteoptimizer.com which then refer's to the domain that I am testing my xss on, using the URL: redirect method.
If I insert a normal text query the output is (varying on the query found or not found), as soon as I insert my payload that is
'-alert(1)-' the website gives me a 403 Access Denied. Normal text inputs are okay and render the page, but inserting any payload just gives me a 403.
Can anyone tell me what's going on? Am I getting an XSS but it's just not popping because of some WAF?