How Create string in Java Script without single or double quote?

Question

I participate in a CTF and I had to steal Admin's cookies. And quotes (single and double) were encoded.

I needed to use document.location=URL for steal cookie, but I can't pass URL using quotes.

So I thought I could just create all (document.location=URL) using a base64 and can pass in eval to execute. But problem is base64 decoding

atob(string)

also needs quotes for pass base64 string.

And then I thought I can use int ascii values and then convert into char and then append all to a string. Still problem here because I can't even create a empty string without quotes.

So I don't know if this is possible or not, But can we create a string just using Java Script(Without using of quotes);

Or there was any other way to steal cookie without passing URL in document.location or img tag?

Feel free to edit question.

Answer 1

The simplest way to make a string without quotes would be from their char codes:

String.fromCharCode(104,101,108,108,111); // "hello"

If backticks are allowed, you could also use ES6 template strings:

`hello`; // "hello"

Another way might be to assemble the string from other strings in the environment.