I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link:

<a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script></div>'>domxss</a>

The injected code appears in a div element in the data-window parameter:

<div id="23212" class="contextMenu" data-window="&quot;><script> alert(document.cookie)</script></div>" style="display: none;"><a .....

I tried to pass &quote as a hex code, double encoded (%2522), with hackbar String.fromCharCode..., but still the double quote is rendered back to &quote;

Any hint for how to bypass the double quote or if there is another way to inject alert here?

  • 1
    Do you know anything about the process by which the payload ends up in the data-window attribute?
    – Anders
    Commented Oct 4, 2018 at 10:31
  • What if you just pass in the hex code for a double quote? since it seems to be translating your HTML entities perfectly fine.
    – xorist
    Commented Oct 4, 2018 at 14:37
  • does the injection appear in view-source?
    – dandavis
    Commented Oct 4, 2018 at 15:54

1 Answer 1


In general, no.

If you see " getting transformed to &quot; as it passes through the HTML, then that usually means that the application is doing output escaping properly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .