I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is the part of payload
javascript:/*</script><img/onerror='-/"/-/ onmouseover=1/-/[`*/[]/[(new(Image)).src=(/;/+/7mu0war5msdjnc8auyu75qw2ntttht9h18p0cs0hX;.burpcollaborator.net/).replace(/.;/g,[])]//'src=>
------WebKitFormBoundaryvITwh4thvzw75H3d
Content-Disposition: form-data; name="description"
The response is as as 
I want help in deciphering of payload because it seems quite convoluted.
<img/onerror='-/"/-/
This is believe causing img tag to fail causing event-handler onerror to trigger but I don't understand the use of '-/"/-/
onmouseover=1/-/[`*/[]/
Similary, as error popups the victim moves his move over and this in return kicks of another event/action which is including src tag and loading external content which is replace with a regex like whatever is in src tag is replace with output of DNS resolution
I appreciate if someone can decode piece by piece how this payload is actually crafted thanks.
