Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        $('div.stabs ul.stranicaNavigation a').click(function () {
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            return false;

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

share|improve this question
up vote 4 down vote accepted

Some obvious things to try are:

blah"; alert('xss'); "blah


blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

share|improve this answer
Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea. – khaomax Oct 31 '12 at 12:05
My favorite payload: "+alert(/xss/)+" – pgolen Oct 31 '12 at 12:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.