Characters that can be used in eval to write code in between

I was asking myself which characters can be used in eval with single quotes that still allow code execution.

Created by: m-boll

Created on: Sunday, May 12, 2024 at 5:02:52 PM

Updated on: Wednesday, July 17, 2024 at 8:39:37 AM

Vector type: JS

Template used:
eval('$[chr]log($[i])$[chr]')
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

eval('	alert(9)	')
eval('alert(11)')
eval('alert(12)')
eval(' alert(32) ')
eval(';alert(59);')
eval(' alert(160) ')
eval(' alert(5760) ')
eval(' alert(8192) ')
eval(' alert(8193) ')
eval(' alert(8194) ')
eval(' alert(8195) ')
eval(' alert(8196) ')
eval(' alert(8197) ')
eval(' alert(8198) ')
eval(' alert(8199) ')
eval(' alert(8200) ')
eval(' alert(8201) ')
eval(' alert(8202) ')
eval('
alert(8232)
')
eval('
alert(8233)
')

Fuzz results

Firefox logo
Firefox 125.0 Unknown Unknown
Found 24 results
DecHexChr
909HT
DecHexChr
110bVT
DecHexChr
120cFF
DecHexChr
3220SPACE
DecHexChr
593b;
DecHexChr
160a0 
DecHexChr
57601680
DecHexChr
81922000 
DecHexChr
81932001
DecHexChr
81942002
DecHexChr
81952003
DecHexChr
81962004
DecHexChr
81972005
DecHexChr
81982006
DecHexChr
81992007
DecHexChr
82002008
DecHexChr
82012009
DecHexChr
8202200a
DecHexChr
82322028
DecHexChr
82332029
DecHexChr
8239202f
DecHexChr
8287205f
DecHexChr
122883000 
DecHexChr
65279feff