Stuck on an endpoint Reflected XSS

Web Hacking
1

They block “()” also tried some encoding. Get this one working javascript:alertdocument.domain
But, it’s printing document.domain, not the domain. I want to print the domain.

1
1744×520 36.2 KB

2

Hi @sa1tama0, Try using utf-8 encoding!

Use \x28\x29 instead of ()

check this encoder link: https://mothereff.in/utf-8

1 Like
3

Thanks for helping me. But problem said, “It’s third-party app” They closed report.