How to bypass firefox xss protection which encodes url and prevents XSS from firing?

Question

XSS

Good afternoon!
I'm learning xss varieties. Now stopped on XSS DOM.
I'm testing everything on the updated dvwa (Damn Vulnerable Web Application).
Most browsers encode the url string and I can't write javascript into the url as I did before. My request is being converted to:

www.xss/com/default=123%253Cscript%253Ealert('XSS')%253C%252Fscript%253E

Hint:
You don't need to do anything on the server side. the protection mechanism is on the client side.
Advise methods of operation or in what direction to move?

Answer 1

Try to apply mixed obfuscated xss-payload.

Answer 2

Hello. If you're using Chrome, then this is the XSS auditor.
I recommend reading the Brute blog on this topic: https://brutelogic.com.br/blog/chrome-xss-bypass/
You can also try https://metascan.ru to automatically search for XSS in the project.
UPD: Actual bypasses for XSS auditor
https://github.com/EdOverflow/bugbounty-cheatsheet...