I was testing example.com and i found a js reflection point. If i send the following request:


I can see the following in server response:

<script nonce="">
window.meta    = {
"token": "Token\"xss=\"'-confirm(1)-'",
"dToken": "dt\"xss=\"'-confirm(1)-'",
"Id": "11"

Is this code vulnerable to Dom Based XSS? If yes, which payload could i try to trigger an alert box?

I already tried to close the </script> tag but < and > are filtered.

  • What does it do with a backslash? Also, your URL and server response don't seem to quite match. Any chance you have a mistake in your question? Nov 23, 2019 at 2:36

1 Answer 1


No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. Because of this it is impossible to inject executable code, opposed to simply changing the content of a JavaScript string variable.

As you pointed out, it is also impossible to close/reopen the script tag.

As noted in the comments, if backslashes are not escaped (which we don't know), you can use an additional \ to escape the first backslash of \" so that it becomes \\" in which case you can break out of the string because the " character is now no longer escaped.

  • If it doesn't escape backslashes then it is vulnerable despite escaping the double quote Nov 23, 2019 at 2:37
  • @ConorMancone, If i insert a single backslash it prints \\\"xss=\"'-confirm(1)-'",
    – Pong
    Nov 26, 2019 at 22:38
  • @Pong if it is escaping backslashes and quotes then it sounds like it is not vulnerable. If they didn't escape the backslash then you could add a backslash before the one that escapes the double quote, turning it into a literal backslash and breaking out Nov 27, 2019 at 0:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .