Characters that can be used in eval to write code in between

Firefox logo 24

I was asking myself which characters can be used in eval with single quotes that still allow code execution.

Created by: m-boll

Created on: Sunday, May 12, 2024 at 5:02:52 PM

Updated on: Wednesday, September 18, 2024 at 11:34:31 AM

Vector type: JS

Template used:
eval('$[chr]log($[i])$[chr]')
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

eval('	alert(9)	')
eval('alert(11)')
eval('alert(12)')
eval(' alert(32) ')
eval(';alert(59);')
eval(' alert(160) ')
eval(' alert(5760) ')
eval(' alert(8192) ')
eval(' alert(8193) ')
eval(' alert(8194) ')
eval(' alert(8195) ')
eval(' alert(8196) ')
eval(' alert(8197) ')
eval(' alert(8198) ')
eval(' alert(8199) ')
eval(' alert(8200) ')
eval(' alert(8201) ')
eval(' alert(8202) ')
eval('
alert(8232)
')
eval('
alert(8233)
')

Fuzz results

Firefox logo
Firefox 125.0 Unknown Unknown

Updated

Sun May 12 2024
Found 24 results
DecHexChr
909HT
DecHexChr
110bVT
DecHexChr
120cFF
DecHexChr
3220SPACE
DecHexChr
593b;
DecHexChr
160a0 
DecHexChr
57601680
DecHexChr
81922000 
DecHexChr
81932001
DecHexChr
81942002
DecHexChr
81952003
DecHexChr
81962004
DecHexChr
81972005
DecHexChr
81982006
DecHexChr
81992007
DecHexChr
82002008
DecHexChr
82012009
DecHexChr
8202200a
DecHexChr
82322028
DecHexChr
82332029
DecHexChr
8239202f
DecHexChr
8287205f
DecHexChr
122883000 
DecHexChr
65279feff