the-web-application-hackers-handbook

470 Chapter 12 n Attacking Users: Cross-Site Scripting
remainder of the line, thus preventing a syntax error caused by the application’s
own string delimiter:
var a = ‘foo\\’; alert(1);//’;
Here, if you find that the backslash character is also being properly escaped,
but angle brackets are returned unsanitized, you can use the following attack:
alert(1)
This effectively abandons the application’s original script and injects a new
one immediately after it. The attack works because browsers’ parsing of HTML
tags takes precedence over their parsing of embedded JavaScript:
var a = ‘alert(1)
Although the original script now contains a syntax error, this does not matter,
because the browser moves on and executes your injected script regardless of
the error in the original script.
TRY IT!
http://mdsec.net/search/48/
http://mdsec.net/search/52/
TIP If you can inject into a script, but you cannot use quotation marks because
these are being escaped, you can use the String.fromCharCode technique to
construct strings without the need for delimiters, as described previously.
In cases where the script you are injecting into resides within an event handler,
rather than a full script block, you may be able to HTML-encode your quotation
marks to bypass the application’s sanitization and break out of the string you
control. For example, if you control the value foo in: