I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not working.
Is there any way that i can show a POC (XSS popup) without using the above keywords.
I successfully injected a frame and cookies are also not HTTP-only.