I was recently figuring out thing in a web application and found that the URL is reflected among the source of the page, which make it bit obvious for XSS, but the input from URL which is reflected on source is assigned inside a <script> tag.


http://www.xyz.com/back?majorID=usdfg&Action=Themesdig&pbPage=vulnerable area&QI.fd_id=random.3232


<script type="text/javascript">
var _TM = {
    cc : 'RUP'
    ,ll : 'en-US'
    ,mkt : 'IN'
    ,geo : 'IN' 

        ,pagename : 'vulnerable area'
        ,pagetype : 'Custom'
        ,channel : 'Custom'


So at first moment, I thought an alert('xxx') is enough to create a POC, but inserting alert or anything else is leading the code to become faulty and not renderable and I cannot close the script tag as the application is sanitizing <, > and ' to their HTML representative.

And the webapp is also accepting hex values. I entered Carriage Return %0D (just to confirm they are accepting) and it worked.
So how can I run JavaScript in this situation and create POC?

During these days, I got a near to complete answer ' };alert(13);var misc={a:b, but the only problem is ' at the beginning. There must be some way to overcome with issue too.

2 Answers 2


So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty

Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. If you did just alert('xxx') and the target site failed to encode it at all, you'd get:

    ,pagename : 'alert('xxx')'

which is indeed a syntax error. You would need to (1) escape the context you are being injected into, with a '; (2) tidy up the surrounding context by finishing the var statement, with };; (3) insert your payload; (4) mask the trailing stuff so it doesn't cause any more errors. ie: '};alert('xxx');/*

If the target site does escape ', then look at other characters that are special in the context of a JavaScript string literal. In particular: the backslash, which introduces escape sequences. If the target remembered to escape ' to \', but didn't escape the backslash itself, giving it \' would end up escaping to \\', which is a literal backslash and then a bare quote, ending the string literal and giving you a chance to exploit again.

The other characters that are special in JavaScript string literals are newlines, including Unicode newlines U+2028/U+2029, but there's not usually much you can do with these because they're simply disallowed and break the code. There are times when terminating a piece of code early can be used in an attack, but it's not the simple direct injection we are talking about here.

i thought of inserting bunch of delete hex encode (i.e %127) to delete the pagetype and channel but the webapp is thinking %127 as %12 and failing my second plan also.

127 is decimal not hex. You wanted %7F.

Delete characters don't have special powers in JavaScript or HTML, you wouldn't be able to escape string literal context like that. The delete character would only actually delete preceding characters when typed into a terminal buffer. Terminal codes are a valid attack against apps that drive other console applications by faking user input, but that's not likely something that a web application is ever going to do.

  • thanks @bobince for your suggestions ,pagename : 'alert('xxx')' is rendered without ' like this ,pagename : 'alert(xxx)' which still can create alert box but not in the given code. '};alert('xxx');/* did not worked because it is missing its pair */ .As you said ( If the target remembered to escape ' to \') no the target forget that, and as you mentioned (Delete characters don't have special powers in JavaScript or HTML, you wouldn't be able to escape string literal context like that) you were right. Please help me again
    – user38257
    Commented Sep 21, 2014 at 18:55
  • If apostrophes are being removed from the input that's still wrong but possibly not exploitable. You should check to see if backslashes are removed too. If not, there are possible attacks with using a trailing backslash to escape the delimiting ', but you then have to be in control of the string following the next ' to inject code there. You could try a more specific trailer like ;var unused={a:', but if you can't get out of the string literal it's not going to do any good.
    – bobince
    Commented Sep 23, 2014 at 11:11

Try inserting

' + alert('xxx') + '

This will render the sourcecode above as

pagename : '' + alert('xxx') + ''

This means in plain English "The value of _TM.pagename is the string which you get when you concatenate an empty string, the return value of calling alert('xxx') and another empty string". To build this string, alert('xxx') will be called.

Because alert doesn't return anything, the pagename will be the string "undefined". Note that this could cause unexpected behavior at a later point in the web application.

  • Oh wow @Philipp thanks bro for another wonderful suggestion but ' is sanitizing leading to become the code un executable.
    – user38257
    Commented Sep 25, 2014 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .