Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?

  • 3
    What do you mean by ‘bypassing escape function in JavaScript’? – Gumbo Nov 29 '11 at 8:58
  • If you're asking if there's a way to make the escape() function behave differently from how it is intended then this would likely amount of a browser specific vulnerability – Andy Smith Nov 29 '11 at 9:49
  • 1
    I don't think you understand what an XSS vulnerability is. Its not a problem with JavaScript, its a problem with the server side code. (Except for dom based xss, but whatever.) – rook Nov 29 '11 at 18:34

Sure, lets say you have the following PHP code that is vulnerable to XSS:

print "<script>var t=escape('".$_GET['t']."')</script>";

You can supply this file with the following XSS Prof of Concept to get an alert window:



If you need to override the escape function for whatever reason (I am assuming an already persistent XSS?) I am pretty sure you can override it by creating an anonymious function similar to this:

(function() {
   window.escape = function() {
      return true;

If however you are looking for general bypassing XSS filters I recommend reading and trying this XSS cheat sheet: http://ha.ckers.org/xss.html

  • window.escape = encodeURIComponent; – Mike Samuel Dec 27 '11 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.