I was testing example.com
and i found a js reflection point. If i send the following request:
https://example.com/?token=test%22test="'-confirm(1)-'
I can see the following in server response:
<script nonce="">
window.meta = {
"token": "Token\"xss=\"'-confirm(1)-'",
"dToken": "dt\"xss=\"'-confirm(1)-'",
"Id": "11"
</script>
Is this code vulnerable to Dom Based XSS? If yes, which payload could i try to trigger an alert box?
I already tried to close the </script>
tag but < and > are filtered.