Apply XSS payload at Directory/File name instead of Parameter

[sn1p3rt3s7]

I have encountered an Content Spoofing in a major website. The website reflects the text inserted after the first fwd slash.
e.g example.com/[dot]content_reflected_on_page
This is reflected on language dropdown section of the page. So I assume the value with dot is considered as a language file.

• example.com/de - displays the page in german, shows de at language dropdown.
• example.com/det - Error page, no reflection
• example.com/anything.visit example.com - displays anything.visit example.com at language dropdown.

However I am not able to break out of the tag. Single, double qoute, gt, lt symbols are encoded before displaying.
Which led me to thinking of trying this on automated tool. But I noticed that the tool allows only injection of payload at parameters.

Solution:

• Add option e.g. -keyword to implement injection of payload at the position of choice using keyword like XSStrike ( like FUZZ keyword in FFUF tool).
• Also an option to inform the tool to include a character ( in this case, dot ) mandatorily.