I have the following setup:
var pos=document.URL.indexOf("user=")+5; var userInput=document.URL.substring(pos,document.URL.length); document.write(unescape(userInput));
Obviously I could just request
and it would be executed, but all inline js is being blocked by my Content-Security-Policy. So what I'm trying to do is to break out of
with something like this:
so that I can get something like this:
Anyone has an idea on how I could achieve that? I'm not bound on document.write, I'm just looking for a DOM-based XSS example where I can inject JS directly into the script file rather then printing it out as inline code.
Sorry if it seems a basic question but I'm not that familiar with JS.
Thanks for the help :)