To infinity and beyond!

[Blocked Image]

I'm still heavily researching Javascript in search of XSS vectors and interesting syntax. I've found loads of cool stuff recently and while looking through the ECMA spec. I came across the Infinity object which is a global and a number, of course I was already aware of it but I thought what kind of interesting code can be constructed with it.

It turns out quite a lot, here's a window.name vector. I've added the variable name to simulate and execute the code.

<pre lang="javascript"> name = 'alert(1)' -Infinity++in eval(1&&name) </pre>

This doesn't look like it could work but does

<pre lang="javascript"> +Infinity++in+alert(1) </pre>

And my final example combines a few different operators:-

<pre lang="javascript"> 1,0000instanceof delete~void--Infinity/~alert(1) </pre>

There are endless possiblities and I'll leave you to play