Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        $('div.stabs ul.stranicaNavigation a').click(function () {
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            return false;

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Some obvious things to try are:

blah"; alert('xss'); "blah


blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

share|improve this answer
Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea. – user1203028 Oct 31 '12 at 12:05
My favorite payload: "+alert(/xss/)+" – pgolen Oct 31 '12 at 12:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.