1
1
1It occurs within a frameset but before a body tag with equals filtered. You would think you could inject a closing frameset followed by a script block but that would be too easy.
0x0D
<!doctype HTML>0x0D
<html>0x0D
<head>0x0D
<title>After Frameset when exists before body and no equals</title>0x0D
<frameset></$[data1]>0x0D
<found><$[data2]></frameset>0x0D
</body>0x0D
</html>