Back to all steps

No global variable

Step fields
window.__variableName (text)
Assert that a given variable is NOT defined on window. Used to verify XSS payload did not execute.
Example: __testmwXss
Usage example

Make sure the given variable is not defined on the global window. The main case is checking that an XSS payload like <script>window.__hack=1</script> did not execute.

Format: variable_name (with or without window. — both work).

Examples:

  • __testmwXss — the standard marker inserted by the xss_lite template
  • window.exploit
  • jQuery — to check that the library is not loaded