0

For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        stranicaContainers.hide().filter('#ageneral').show();
        $('div.stabs ul.stranicaNavigation a').click(function () {
            stranicaContainers.hide();
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            $(this).addClass('selectedstranica'); 
            return false;
        }).filter(stranica).click();
    });
</script>

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

1 Answer 1

4

Some obvious things to try are:

blah"; alert('xss'); "blah

or

blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

2
  • Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea.
    – Daniel
    Commented Oct 31, 2012 at 12:05
  • 5
    My favorite payload: "+alert(/xss/)+"
    – pgolen
    Commented Oct 31, 2012 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .