I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains.
My url currently looks like this:
http://s1.example.com/u/%22%3E%3Cmeta%20http-equiv=Set-Cookie%20content=%22sid=1234;%20path=/;%20expires=Thursday,%2020-May-15%2000:15:00%20GMT;%20domain=example.com%22%3E
The issue is that for some reason or another, the character "/" is filtered out (no other characters are), meaning that although I can set cookies to the main site and all it's subdomains, I can only set them to the path /u/ as that is where the attack is launched from on the subdomain. Is there any way to set the path to / without actually using the /
?
Thank you very much for any help!