I was using Burp Suite for some testing and I noticed that they included the following string:


as an attack string for an XSS payload.

How could this string be used to execute a XSS attack?


In this case the first \ is escaping an escape to provide attacker with a un-escaped double-quote:

var x="\\";alert('XSS');//"

This is assuming the target application has a broken escape routine.

| improve this answer | |

The purpose of the string is to test if JavaScript injection is possible. It will not do harm itself, only show an alert box with the message "XSS" which would mean that you successfully injected the website with some JavaScript. Then, an attacker could inject any JS to perform an XSS attack.

| improve this answer | |

I am not sure about this scenario, but think of it like this.

The application is providing, a javascript an input from what the user provided.




"some value the user input here"


In that situation, the Script tags are not necessey, but only the code will work as an XSS. For such a situation, the code \";alert('XSS');// will be neccessary. Just sharing a thought.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.