Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.

The application has a filter wich detects special characters and some strings, as well I can bypass the filter for the string recognition injecting null values (< scr%00ipt> ) between its chars, but I can't figure out how to bypass it for a single character.

Allowed chars: :  / & @ - { } < > \ . , ' "
Disallowed chars: = ( ) # ;

The filter does not use character conversion and when something disallowed is detected it displays an error message: Invalid Parameters detected

Maybe I'm missing something but today I don't see how to execute javascript under this conditions. Any idea?

share|improve this question
Have you tried encoding the brackets? – Lucas Kauffman May 29 '13 at 14:05
Yes but %28 or %29 is also detected and &#xXX is not valid because # is not an allowed character. – Nucklear May 29 '13 at 14:16
I updated my post. – rook May 31 '13 at 14:53

Yes, this is possible. There's a trick you can do with onerror:

<img src=x onerror=eval;throw'=alert\x281\x29';>

The throw generates a JavaScript string which is then passed back into eval because the throw constitutes an error. This gives you full arbitrary JavaScript injection.

OK, so you say we can't use an equals sign. Instead, I suggest this trick:


This includes a 3rd party CSS file into the page. From there you can launch JavaScript:

body {
    background-image: url('javascript:alert(document.cookie);')

There are also other tricks you can use to gain JavaScript execution from CSS.

share|improve this answer
As I said to Rook, the equal character is also filtered so I cant use this method, there is a list of allowed characters in the question. – Nucklear May 29 '13 at 14:20
@Nucklear Did you edit? I don't remember seeing the equals sign the first time around... – Polynomial May 29 '13 at 14:22
I didn't. Also OT, I'm trying to inyect through CSS but I can't do it without the disallowed characters... – Nucklear May 29 '13 at 14:27
@Nucklear I've added a second method using off-site CSS, with no = or parenths. – Polynomial May 29 '13 at 14:28
@Nucklear There are no parentheses in the injected code. The CSS file is stored on a 3rd party site and will therefore not be subject to the WAF filters. The bottom code I showed was meant to be the contents of xss.css – Polynomial May 29 '13 at 14:35

Blocking parenthesis is strange, I am not aware of any attack that this prevents. XSS without parenthesis is possible.

For browsers that support svg:


If you just want a simple PoC then this should work:

<script>alert;throw 1;</script>

But a real world exploit doesn't require parenthesis:

share|improve this answer
Hi @Rook, thanks for the response but I already tried this, the problem is that the equals symbol is also filtered and it doesn't work. – Nucklear May 29 '13 at 14:13
@Rook, you seem to know a ton on security issues. Just wondering... how old are you btw? – Pacerier Jan 31 '14 at 6:06
For the POC, the throw 1 works, but why is the alert there? It doesn't seem to do anything. – gsingh2011 Sep 26 '15 at 5:19

Simple trick with VBScript: <input onfocus=vbs:msgbox+1> [works in IE]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.