Characters that can precede the javascript protocol

Characters that can precede the javascript protocol in html

Created by: renniepak

Created on: 4/10/2024, 8:51:01 AM

Updated on: 7/14/2024, 11:48:39 PM

Vector type: XSS

Template used:
<a href="$[chr]javascript:test.com/" id="test"></a>
Code used after fuzz:
if(document.getElementById("test").protocol=="javascript:"){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="	javascript:test.com/" id="test"></a>
<a href="
javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="
javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href="javascript:test.com/" id="test"></a>
<a href=" javascript:test.com/" id="test"></a>

Fuzz results

Chrome logo
Chrome 124.0.0.0 Unknown Unknown
Found 32 results
DecHexChr
101SOH
DecHexChr
202STX
DecHexChr
303ETX
DecHexChr
404EOT
DecHexChr
505ENQ
DecHexChr
606ACK
DecHexChr
707BEL
DecHexChr
808BS
DecHexChr
909HT
DecHexChr
100aLF
DecHexChr
110bVT
DecHexChr
120cFF
DecHexChr
130dCR
DecHexChr
140eSO
DecHexChr
150fSI
DecHexChr
1610DLE
DecHexChr
1711DC1
DecHexChr
1812DC2
DecHexChr
1913DC3
DecHexChr
2014DC4
DecHexChr
2115NAK
DecHexChr
2216SYNC
DecHexChr
2317ETB
DecHexChr
2418CAN
DecHexChr
2519EM
DecHexChr
261aSUB
DecHexChr
271bESC
DecHexChr
281cFS
DecHexChr
291dGS
DecHexChr
301eRS
DecHexChr
311fUS
DecHexChr
3220SPACE
Firefox logo
Firefox 124.0 Unknown Unknown
Found 32 results
DecHexChr
101SOH
DecHexChr
202STX
DecHexChr
303ETX
DecHexChr
404EOT
DecHexChr
505ENQ
DecHexChr
606ACK
DecHexChr
707BEL
DecHexChr
808BS
DecHexChr
909HT
DecHexChr
100aLF
DecHexChr
110bVT
DecHexChr
120cFF
DecHexChr
130dCR
DecHexChr
140eSO
DecHexChr
150fSI
DecHexChr
1610DLE
DecHexChr
1711DC1
DecHexChr
1812DC2
DecHexChr
1913DC3
DecHexChr
2014DC4
DecHexChr
2115NAK
DecHexChr
2216SYNC
DecHexChr
2317ETB
DecHexChr
2418CAN
DecHexChr
2519EM
DecHexChr
261aSUB
DecHexChr
271bESC
DecHexChr
281cFS
DecHexChr
291dGS
DecHexChr
301eRS
DecHexChr
311fUS
DecHexChr
3220SPACE