Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I want to show it while a presentation as an example of state of the art XSS. Or what are other really surprising XSS examples?

share|improve this question
It's worth pointing out that this is only a XSS vulnerability if your site executes javascript code that could be provided by untrusted users and your only safeguard is blacklisting certain keywords (which is the wrong solution). You should always use a whitelist policy/safer markup language that prevents users from executing javascript code (e.g., in comments they can't insert <script> tags, add onclick/onhover-type methods to html tags, or use eval on user provided input in your js, etc.). Then this just is obsfuscation. – dr jimbob Dec 15 '11 at 22:08
up vote 23 down vote accepted

Found it

Converter to convert normal JS into brackets only JS:

share|improve this answer
wow I didn't even think that was possible! time to modify my code filters! (and the next time somebody asks for an obfuscated program on I'll use this :) – Nate Koppenhaver Oct 20 '11 at 1:24
Wow. I'll confess, when I read your question, I thought, "Man, this guy really doesn't know what the hell he's talking about." (I've been writing JavaScript for years.) Now, seeing this? Head asplode. – chrisallenlane Dec 15 '11 at 15:13

This is an interesting find!

To those who are only just now finding out...

It is now obvious how you can create strings out of braces, and you could do things like window[gibberish](gibberish) to eval something. What may not be clear is that you can do this without the word window. All you need is a variable name (like $ or _)

Run this prep code


You will have a function.

Run this to call alert(0) on that function



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.