While testing a website i noticed that the value of parameter username
is reflected inside the javascript code of the response. It's insert into a variable like this one:
var valueUser = "my-controlled-value";
How can i trigger an alert box inside the javascript function?
Here's what i tried.
Tried to close the script tag but i get a connection timeout (probably some kind of WAF. I think the only solution is to break the javascript function and trigger the alert
Tried to use this payload
test"; alert(1);//
but it's not workingAlso the only block is that when you insert " it will be converted to \" all the other symbols are not escaped
What payload can i use to make it work and trigger the alert box?
'
and others like;
+
,
{}
()
[]
and all others used by javascript. 0xbf5c is printed as0xbf5c
, same for the other one. What should i try?