A website reflects the parameter I send, but the user input is accepted in the form of string.
Hence whatever I search is reflected as
<meta property="og:title" content="hello _userinput_ to xyz" />
in the source code.
I tried to end the string sequence with " but the " character is filtered using "
So the above code becomes
<meta property="og:title" content="hello " to xyz" />
Also I noticed that certain keywords like > returns >
I also tried to start from newline using the # character, but that gives me a 400 bad request.
Now, because my input is getting reflected in the page, I thought I could carry out an XSS attack.
Is it possible to escape the string and execute any script there?