I'm having this super hard XSS challnge. I'm in the JavaScript tag already so all I need to do is just pop up an alert box. The problem is that I just can't use a lot of alert options:

  • alert turns to Alert
  • confirm turns to Confirm
  • prompt turns to Prompt
  • window turns to WINDOW
  • eval turns to EVAL

I tried to URL encode it but it dosn't work. What else can I do? Are there more options like alert that are not in the list?

  • I don't know if it must be an alert from javascript but maybe something from jquery would also work. jqueryui.com/dialog/#modal – Lexu Aug 19 '16 at 13:13
  • constructor.constructor(atob("YWxlcnQoNjY2KQ=="))(); or ({}).constructor.constructor(atob("YWxlcnQoNjY2KQ=="))(); – dandavis Sep 1 '16 at 10:55

Does this still work? If so, you can try:

<script>this["al" + "ert"]("Test")</script>
| improve this answer | |
  • 2
    @ShaiAlfasi If this answer helped you and solved your problem, you can mark it as accepted by clicking the check box under the score to the left of the post. – Anders Aug 19 '16 at 14:27
  • note that if "use strict" was globally applied before the above code it will throw. – dandavis Sep 1 '16 at 10:54

If for your challenge VBScript is allowed, your XSS should work in Internet Explorer:

<script language=VBScript>MsgBox "XSS"</script>

VBScript isn't case sensitive, so even if the above is changed to Msgbox or MSGBOX then the attack should still work.

| improve this answer | |

There is tons of javascript code obfuscation generator.
Some infamous generator are Hieroglyphy and jsfuck

If all this code is injected before the script, and call it afterwards, it will defeat all javascript function replacement. This will escape most of the javascript function replacement tricks. E.g. if some program saw the "this" and replace it, then there is a no go.

Nevertheless, if a plugin replace the function with other stuff, it will cripples most XSS. E.g.

# if the plugin sit on the background and run this before the tab/page XSS
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.