XSS Attacks

138 Chapter 3

9

XSS Theory

If the developer made the mistake of only escaping double quotes, then the trick to

evading this filter is to escape the escape character and use single quotes within the alert

function. The following illustrates how this would be rendered:

<script>

var query_string="\\" ;alert ( 'XSS' ) ;//" ;

somefunction (query_string) ;

function somefunction {

...

}

As you can see there are now

two

slashes in the

query_string

variable. We injected the

first one and the system added the second one to escape the single quote. However, since

our first ~' renders