I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. 

My url currently looks like this:

http://s1.example.com/u/%22%3E%3Cmeta%20http-equiv=Set-Cookie%20content=%22sid=1234;%20path=/;%20expires=Thursday,%2020-May-15%2000:15:00%20GMT;%20domain=example.com%22%3E


The issue is that for some reason or another, the character "/" is filtered out (no other characters are), meaning that although I can set cookies to the main site and all it's subdomains, I can only set them to the path /u/ as that is where the attack is launched from on the subdomain. Is there any way to set the path to / without actually using the /?

Thank you very much for any help!


Question: Rotating vector3 by a quaternion
Answer: Here is an alternative way to transform a vector by a quaternion. It is the way MS does it in the xna framework.
http://pastebin.com/fAFp6NnN