I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link:
<a href="wepage.jsp" target='"><script> alert(document.cookie)</script></div>'>domxss</a>
The injected code appears in a
div element in the
<div id="23212" class="contextMenu" data-window=""><script> alert(document.cookie)</script></div>" style="display: none;"><a .....
I tried to pass
"e as a hex code, double encoded (
%2522), with hackbar
String.fromCharCode..., but still the double quote is rendered back to
Any hint for how to bypass the double quote or if there is another way to inject alert here?