I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.

The application has a filter wich detects special characters and some strings, as well I can bypass the filter for the string recognition injecting null values (< scr%00ipt> ) between its chars, but I can't figure out how to bypass it for a single character.

Allowed chars: :  / & @ - { } < > \ . , ' "
Disallowed chars: = ( ) # ;

The filter does not use character conversion and when something disallowed is detected it displays an error message: Invalid Parameters detected

Maybe I'm missing something but today I don't see how to execute javascript under this conditions. Any idea?

  • Have you tried encoding the brackets? May 29, 2013 at 14:05
  • Yes but %28 or %29 is also detected and &#xXX is not valid because # is not an allowed character.
    – Nucklear
    May 29, 2013 at 14:16
  • I updated my post.
    – rook
    May 31, 2013 at 14:53

4 Answers 4


Yes, this is possible. There's a trick you can do with onerror:

<img src=x onerror=eval;throw'=alert\x281\x29';>

The throw generates a JavaScript string which is then passed back into eval because the throw constitutes an error. This gives you full arbitrary JavaScript injection.

OK, so you say we can't use an equals sign. Instead, I suggest this trick:


This includes a 3rd party CSS file into the page. From there you can launch JavaScript:

body {
    background-image: url('javascript:alert(document.cookie);')

There are also other tricks you can use to gain JavaScript execution from CSS.

  • 1
    As I said to Rook, the equal character is also filtered so I cant use this method, there is a list of allowed characters in the question.
    – Nucklear
    May 29, 2013 at 14:20
  • @Nucklear Did you edit? I don't remember seeing the equals sign the first time around...
    – Polynomial
    May 29, 2013 at 14:22
  • I didn't. Also OT, I'm trying to inyect through CSS but I can't do it without the disallowed characters...
    – Nucklear
    May 29, 2013 at 14:27
  • @Nucklear I've added a second method using off-site CSS, with no = or parenths.
    – Polynomial
    May 29, 2013 at 14:28
  • 1
    @Nucklear There are no parentheses in the injected code. The CSS file is stored on a 3rd party site and will therefore not be subject to the WAF filters. The bottom code I showed was meant to be the contents of xss.css
    – Polynomial
    May 29, 2013 at 14:35

Blocking parenthesis is strange, I am not aware of any attack that this prevents. XSS without parenthesis is possible.

For browsers that support svg:


If you just want a simple PoC then this should work:

<script>onerror=alert;throw 1;</script>

But a real world exploit doesn't require parenthesis:

  • Hi @Rook, thanks for the response but I already tried this, the problem is that the equals symbol is also filtered and it doesn't work.
    – Nucklear
    May 29, 2013 at 14:13
  • @Rook, you seem to know a ton on security issues. Just wondering... how old are you btw?
    – Pacerier
    Jan 31, 2014 at 6:06
  • 1
    For the POC, the throw 1 works, but why is the alert there? It doesn't seem to do anything.
    – gsgx
    Sep 26, 2015 at 5:19
  • the PoC should actually look like this: <script>onerror=alert;throw 1;</script>. you're registering alert as a global error-callback and then throw an error (causing alert to be called)
    – TomTasche
    Mar 27, 2017 at 12:50
  • @TomTasche ah, that makes sense, thanks for the explanation, updated.
    – rook
    Mar 27, 2017 at 17:38

Simple trick with VBScript: <input onfocus=vbs:msgbox+1> [works in IE]


How about if all the special characters are filtered out. I am testing a site which does not allow to enter special chars to be entered in search bar.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .