I have a site that is vulnerable to alert(1); but not vulnerable to alert('Alert'); Is it vulnerable? For some reason it is not possible to pass text, only numbers. Is it possible to invade or do something ?!

closed as unclear what you're asking by techraf, SilverlightFox, schroeder Apr 9 '17 at 12:19

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Welcome to security.SE. I voted to close, because it sounds like you want us to break the security of a specific system for you. To be on-topic, you need to add a lot more information (what did you try, etc). More information is also necessary for us to even attempt to answer (otherwise, we would just be guessing). How does the reply actually look? Are single quotes encoded? etc. – tim Apr 9 '17 at 11:43
  • 1
    Is it vulnerable? Yes, you just proved it was. Is it possible to do "invade"? We have no clue with only the single detail that you provided. – schroeder Apr 9 '17 at 12:19
  • This question needs more detail. What exactly is filtered? Quotes/single quotes or alphanumeric characters themselves? Please edit with examples and any research. – SilverlightFox Apr 9 '17 at 12:19

To answer your question: Yes the site is vulnerable to Cross Site Scripting attacks (XSS) because you are actually able to execute JavaScript code in the context of the website (alert(1)).

The question is: Can you use it to to bad things like steal Session information, CSRF tokens, etc.... This depends on what JavaScript code you are able to inject into the website - when it is only possible to inject certain characters, it gets hard (but not impossible) to perform attacks like Cookie stealing or stealing the CSRF tokens... To learn what you can do with XSS, read the OWASP site (there is also a secrion which describes how to bypass certain XSS filters):

It seems that the server is protected by a Web Application Firewall (WAF) or something similar which filters certain characters out of the request ... To bypass such filters there are many resources online:

Use Google to find more ;)

The essential thing here seems to bypass the WAF - you are able to inject certain JavaScript but not all - when you bypass the protection of the WAF you will be able to inject all kind of JS and you will be able to perform more complex attacks.

Be also aware that Browsers like Chrome have a built-in XSS protection which can also block such attacks.

Not the answer you're looking for? Browse other questions tagged or ask your own question.