I am able to get reflected XSS through burp repeater using a GET request. I then click on show response in browser and I am able to get an XSS alert. But when I manually go to the URL in my browser the payload is not executed!
When I was using payloads like this in my Burp reapeater I was able to get an alert:
"><html><body><script>alert("1")</script></body></html>
But when I go to same URL, like
https://example.com/exp="><html><body><script>alert("1")</script></body></html>`
it gets encoded into
https%3A%2F%2Fexample.com%2Fexp%3D%22%3E%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert%28%221%22%29%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E
in the burp interceptor and the XSS doesn't execute. Any workaround for this?
https://example.com/
(so not just the parameters)?