Bypassing encodeURIComponent to Get XSS

In this video, I've explained how you can bypassing encodeURIComponent to Get a Reflected XSS.

Books to get started on hacking:

Buy me a Coffee:
Support me on Patreon:

[francozanardi]

You are wrong. You are not bypassing encodeURIComponent here. Your payloads work since the `var searchTerms = '...'` code. The 'search' parameter is being reflected twice. When it is reflected in the JavaScript code (the value of the searchTerms variable), you can introduce your own code. In order to do that, you need to close the string value using the single quoutes. So, something like this would work perfectly:
'alert(1);// ----> It works since you close the string, then put your own JS code and then comment the rest of the line.

[vasudhagupta-ghdh]

i tried this also but it still not worked bypasses this type or payload also ..now what else can we try

[dankmemes]

Hi! Im trying to bypass a filter on a webpage that only accepts some limited alphanumeric 11 character strings. What could be the easiest ways to do that? Is it even possible?

[ozkanaltunbas]

if ' char is escaped what will we do bro ?

[krivadnaaiservices]

U can't crack flipkart Or rediff.. Stick to solving labs only