I was reading this article here, in the middle I saw the author used -confirm()- as the payload.
I'd like to know what is this payload? I mean what's the difference between -confirm()- and <script>confirm()</script> . Why does it work while <script>confirm()</script> doesn't ?
It would be so much appretiated if anyone sheds some light on this.


1 Answer 1


The issue is the missing escape character \ in the last parameter.

You can try it with an empty function:


function somefunction(){
//do nothing

somefunction( 'wskw='-confirm(1)-'');
somefunction( 'wskw='+confirm(2)+'');
somefunction( 'wskw='*confirm(3)*'');
somefunction( 'wskw='/confirm(4)/'');
somefunction( 'wskw='%confirm(5)%'');

It is the same like <script>alert(1)</script> or <script>confirm(1)</script>

You can test it with this fiddle: https://jsfiddle.net/v7y3x1yt/

Generally the input should be always urlencoded, like %27 instead of '. They forgot to escape the second parameter.

'' closes the string and after the ' there can be any JavaScript code which will be executed which needs to be encapsulated in any of the following arithmetic JavaScript operators (-, +, *, / %). What is happening here is a calculation with the result of the alert() or confirm() function call which has to be executed to get the result.

As the code is directly in this form in the sourcecode, it is generated on the server-side and there is the problem with the missing escaping of the parameter, there is not directly a XSS vulnerability in the JavaScript libraries. Theoretically this unescaped code works with any function and library in JavaScript. The problem is the generation of the code on the server-side.

<script type="text/javascript">
// Redirect click tracking
$.sliLinkTracker( ".redirect-link",'some_url_with_escape_characters', 'wskw='-confirm(1)-'');

Generally I would contact the owner of the website and disclose this to them as this is critical.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .