I found a website that reflected back the user inputs. But the problem is when I inject this payload
<svg/onload=alert(1)> I get an error.
But when I use this payload
<%20svg/onload=alert(1)>, my input reflects back to the screen but I can't make the alert pop up. And this document says that there should not any white space between
< and the tag name.
So I can't use any payload which starts with
< and tag name for ex.
So, Is there any trick?
But the result same, my input reflects back without any problem, but no alert pops up.
So, Is the result is "It can't bypass"? What am I missing here?