I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is the problem. It is not possible to initialize foo_var with the same payload. The character ) is the problem. Any ideas?

function foo1(){

    if('EUR66038');}confirm(1);/* != 'blabla'

    Some comments

function foo2()
    var foo_var= 'EUR66038');}confirm(1);/* //Comment

1 Answer 1


The following payload will work:


Encoded version:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .