how to exploit inJS-none method

[Tamil-dev]

inJS-none :(

[hahwul]

Hi @Tamil-dev
inJS-none means that the insertion occurred in the area that is not surrounded by special characters within the Javascript area.

e.g

• inJS-none: var a = INJECTED
• inJS-single: var a = 'INJECTED'
• inJS-double: var a = "INJECTED"

For example, you could attack like this.

var a = alert(document.location.href)

It's hard to make it an PoC because I don't know your response data. Either way, dalfox wrote data in the JS area, which means that JavaScript is likely to be available.