Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        stranicaContainers.hide().filter('#ageneral').show();
        $('div.stabs ul.stranicaNavigation a').click(function () {
            stranicaContainers.hide();
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            $(this).addClass('selectedstranica'); 
            return false;
        }).filter(stranica).click();
    });
</script>

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Some obvious things to try are:

blah"; alert('xss'); "blah

or

blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

share|improve this answer
    
Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea. –  user1203028 Oct 31 '12 at 12:05
3  
My favorite payload: "+alert(/xss/)+" –  pgolen Oct 31 '12 at 12:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.