---
id: 5539
title: "Executing non-alphanumeric JavaScript without parenthesis"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/executing-non-alphanumeric-javascript-without-parenthesis"
published_at: "2020-07-02T12:05:00Z"
tags: ["xss", "obfuscation", "javascript", "filter-bypass", "template-literals"]
phying_url: "https://phying.com/item/5539"
lang: en
---

# Executing non-alphanumeric JavaScript without parenthesis

## Summary

Gareth Heyes executes non-alphanumeric JavaScript without parentheses by abusing template literals and Array.prototype.find, building filter-evading XSS payloads that previously helped hack Uber.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-07-02T12:05:00Z
- **Original:** https://portswigger.net/research/executing-non-alphanumeric-javascript-without-parenthesis
- **Phying News:** https://phying.com/item/5539