5

In an XSS attack (proof of concept for pen testing reasons), the following string is appended to a url:

;alert(String.fromCharCode(88,83,83));(1

I understand what the ;alert(String.fromCharCode(88,83,83)) does (it just creates an alert dialog saying "XSS"). What I don't understand is why it needs the ;(1 for it to work.

What is the need for that last piece of text? Also why have the number 1? I tried letters and different numbers and both worked.

  • 5
    it's likely to make it fit in-place without a syntax error, which would stop all code from executing. an invalid letter would name an unused variable which would error (ref er) once it got there, but not before anything ran. – dandavis Jul 5 '17 at 16:52
  • 2
    @dandavis But the string introduces an imbalance of parens. Not sure in which context that makes sense if you're not also commenting something out, etc. – Arminius Jul 5 '17 at 18:19
  • As Arminius said. Without the context is impossible to answer. – Siracuso Jul 5 '17 at 18:58
  • @Arminius: i'm explaining the part that's explainable, context would be speculative. – dandavis Jul 5 '17 at 19:08
1

As far as I think, the

; in ;(1 is just for ending the alert tag.

And since you haven't mentioned in which context are you using this payload, it will be best to say that the ( is simply starting because there must be another ) after that so that the two parenthesis can match.

Also, as you are concerned about 1, I think, you can write anything there "aaa" or "blahblahblah" will also work.

P.S. You have yourself mentioned in the question that both numbers and strings worked. When you are using this payload, just check in the response where does it get inserted. So that you can see by yourself how one parenthesis is used for closing the other to make a valid statement. Cheers..:)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.