I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser:
The only issue is that the colon gets URL encoded, which prevents the css from rendering.
The reflected output looks like this:
I've tried common XSS attacks, but a WAF seems to block most event handlers.
Is there a way to get CSS injection without the colon or with an alternative character?