1

I need help with the following. I have this Javascript source code:

<script type='text/javascript'>
/* <![CDATA[ */
var settings = {"Url":"someValue","Variable":{"message":"[injection point]"}};
/* ]]> */
</script>

Now I want to inject Javascript at [injection point] in the JSON string. The problem is that I can't use " and /. I can use all other chars, such as < or >.

  • try encoding it – Tryna Learn Somethin May 18 '18 at 22:43
  • i tried but it doesnt work – Robert Beran May 19 '18 at 6:59
  • ' and ` are valid string delimiters in JS. good luck on the slash. – dandavis May 19 '18 at 21:18
  • ok i get something to work without slashes: <iframe src=javascript:alert();> - now i just need to work within the code :) – Robert Beran May 20 '18 at 7:11
  • okay - the problem is, that the " is escaped and not complete filtered out - maybe this helps ... – Robert Beran May 20 '18 at 7:55

Browse other questions tagged or ask your own question.