0

While testing a website i noticed that the value of parameter username is reflected inside the javascript code of the response. It's insert into a variable like this one:

var valueUser = "my-controlled-value";

How can i trigger an alert box inside the javascript function?

Here's what i tried.

  • Tried to close the script tag but i get a connection timeout (probably some kind of WAF. I think the only solution is to break the javascript function and trigger the alert

  • Tried to use this payload test"; alert(1);// but it's not working

  • Also the only block is that when you insert " it will be converted to \" all the other symbols are not escaped

What payload can i use to make it work and trigger the alert box?

Improve this question
8
  • @VipulNair, Both " and / are converted to /" and \/ But i can use brackets and symbols like ; single quote ' and others.
    – Disp Lay
    Aug 30, 2019 at 22:26
  • When you say your payload isn't working, what is the result? When you say all other symbols, what do you mean? Does it include unicode strings such as 0xbf5c and 0xbf27?
    – LTPCGO
    Aug 30, 2019 at 23:08
  • The result is page loading without alert. If i look at source code i can see my payload injected but not working. It doesn't break the string. All others symbols except for \ and " are not escaped. I can use single quotes ' and others like ; + , {} () [] and all others used by javascript. 0xbf5c is printed as 0xbf5c, same for the other one. What should i try?
    – Disp Lay
    Aug 30, 2019 at 23:17
  • These values are hex and should be injected into your data stream directly. Simply writing it out in the text box or similar will not prove useful.
    – LTPCGO
    Aug 30, 2019 at 23:20
  • It 'not working' should be apparent in the console of whatever Dev tools you are using, if you aren't seeing the alert or an associated error then I assume you are trying to inject a payload into a function which isn't being called. With the information you've provided it's very difficult to give an answer as there are too many unknowns.
    – LTPCGO
    Aug 30, 2019 at 23:23

1 Answer 1

Reset to default
1

Is \ converted to \\? If not, break out of the string using \"; it'll be converted to \\", which will be treated as a sole (escaped) backslash and then a string-terminating quotation mark.

Inserting a newline will break the string, but also break the JS application. If you don't have some way to recover from that - such as the ability to insert a new script block on the same page - that's probably acceptable, but you already said that closing the script tag (presumably to then open a new one) doesn't work.

Improve this answer
2
  • I tried with ` and it's converted to \` and if i try with \" it gets converted to \\\" - I tried closing the script tag but in that case the server won't respond or will give a 200 code with an empty response.
    – Disp Lay
    Aug 30, 2019 at 22:54
  • 1
    You should edit your question then, since you said "... all other characters are not escaped" and it sounds like at least two other characters are, in fact, escaped. You might want to try all non-alphanumeric characters (certainly all the ones in printable ASCII) to see what actually is an is not escaped.
    – CBHacking
    Aug 31, 2019 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .