First of all i don't know if this question already mention here, believe me i search already.
so i was trying to break string inside single and double quote of attr below;
onclick="window.location='{$url4stat}en'"
now lets say the webapps urls like http://example.com/index/
i was able to inject random param after the /index/ path which is /index/?rand=123 and was included in respond boby such; onclick="window.location='/index/?rand=123&stat=en'"
so i though it might work somehow putting a double quote "
and see if the html respond body breaks. turns out it gets encoded %22
onclick="window.location='/index/?rand=%22&stat=en
so putting lazy "><script>alert(1)</script>
payload will useless ( i've tried )
But, using burpsuite i was able to edit the encoded request before being send to webserver, when open the respond body in browser the alert just pop! is this means that it's prone to XSS ? if so, my question is it possible to bypass this? i already try double encode, using hex, %23x, and many other payload but nothing's work. turns out double encode payload will stay, if i put %2522
the respond body becomes onclick="window.location='/index/?rand=%2522&stat=en
nothing change, same with other payload. it looks like only a few char such ", ', >, <,
will be encoded. if i ran into IE Browser, the payloads work. only Chrome,FF, have not yet tried on Opera and Safari.
Will appreciate any suggestion,technique,payloads.