I was reading this article here, in the middle I saw the author used -confirm()- as the payload.
I'd like to know what is this payload? I mean what's the difference between -confirm()- and <script>confirm()</script> . Why does it work while <script>confirm()</script> doesn't ?
It would be so much appretiated if anyone sheds some light on this.

  • Now I am on my PC and found the issue. Also funny what the author tries to do on the right side (what not works): "'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></| \><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1) </script>"><img/id="confirm&lpar;1&#x29;"/alt="/"src="/"onerror=eval(id&#x29;>'"><img src="i.imgur.com/P8mL8.jpg">" – Daniel Ruf Dec 5 '15 at 11:30
  • @DanielRuf - deleting comments that are part of a conversation makes reading very confusing. – Neil Smithline Dec 5 '15 at 16:56

The issue is the missing escape character \ in the last parameter.

You can try it with an empty function:


function somefunction(){
//do nothing

somefunction( 'wskw='-confirm(1)-'');
somefunction( 'wskw='+confirm(2)+'');
somefunction( 'wskw='*confirm(3)*'');
somefunction( 'wskw='/confirm(4)/'');
somefunction( 'wskw='%confirm(5)%'');

It is the same like <script>confirm(1)</script> or <script>confirm(1)</script>

You can test it with this fiddle: https://jsfiddle.net/v7y3x1yt/

Generally the input should be always urlencoded, like %27 instead of '. They forgot to escape the second parameter.

'' closes the string and after the ' there can be any JavaScript code which will be executed which needs to be encapsulated in any of the following arithmetic JavaScript operators (-, +, *, / %). What is happening here is a calculation with the result of the alert() or confirm() function call which has to be executed to get the result.

As the code is directly in this form in the sourcecode, it is generated on the server-side and there is the problem with the missing escaping of the parameter, there is not directly a XSS vulnerability in the JavaScript libraries. Theoretically this unescaped code works with any function and library in JavaScript. The problem is the generation of the code on the server-side.

<script type="text/javascript">
// Redirect click tracking
$.sliLinkTracker( ".redirect-link",'some_url_with_escape_characters', 'wskw='-confirm(1)-'');

Generally I would contact the owner of the website and disclose this to them as this is critical.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.