If you want to get anywhere in security and finding bugs, bypassing security measures you need to start to get more creative and more experimentative (if that's even an english word).
In this case:
- Choose an input.
- Feed it through the black box.
- Get the output
- Make a theory: How does the black box transform my input -> output
- Choose a different input and repeat until confident that you're theory is correct.
- Adapt/update/change theory with new information from
(input, output) pairs.
A possible theory in this case would be that the black box simply replaces
https with an empty string. How do we verify this: Well... we enter "hihttpsthere" and see if we get "hithere" as output. But it transform
:? Maybe it tries to parse the protocol of the URL? Use some urlencoded stuff, use non-printable characters, maybe even use a fuzzer? It could even be that their filter makes an XSS impossible.. could be. You'll have to find out.
It's all about trial and error.
I was trying to get xss but site valdiate input
That's what it's supposed to do anyway. You can't expect that you can do an XSS everywhere.