I was reading about JSf**k. From their website:
JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and execute code.
My question is: When exactly can we use such a payload to exploit an XSS vulnerability? I tried the following simple HTML code to test it:
<html>
<img src=1 onerror="(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]" >
</html>
I've just replaced the alert(1)
with the corresponding plain text JSF**k code. However, the browser does not seem to render the payload. When I'm type the payload in Chrome's console, it is rendered as a string "alert(1)" but does not work in the above HTML code. I guess that has to do something with how a browser renders these payloads (I'm not fully aware of how/when exactly a browser renders various types of payloads).
I would like to understand the scenarios where such payloads can be useful while testing a web application.
UPDATE: As mentioned in the answer, the method works when using eval source instead of normal alert(1) string. My question is, why do I need an eval source? AFAIK, the browser should execute the string passed to the onerror attribute as JavaScript.
alert