Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was using Burp Suite for some testing and I noticed that they included the following string:


as an attack string for an XSS payload.

How could this string be used to execute a XSS attack?

share|improve this question
up vote 13 down vote accepted

In this case the first \ is escaping an escape to provide attacker with a un-escaped double-quote:

var x="\\";alert('XSS');//"

This is assuming the target application has a broken escape routine.

share|improve this answer

The purpose of the string is to test if JavaScript injection is possible. It will not do harm itself, only show an alert box with the message "XSS" which would mean that you successfully injected the website with some JavaScript. Then, an attacker could inject any JS to perform an XSS attack.

share|improve this answer

I am not sure about this scenario, but think of it like this.

The application is providing, a javascript an input from what the user provided.




"some value the user input here"


In that situation, the Script tags are not necessey, but only the code will work as an XSS. For such a situation, the code \";alert('XSS');// will be neccessary. Just sharing a thought.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.