Characters that can precede the javascript protocol

Characters that can precede the javascript protocol in html

Created by: renniepak

Created on: Wednesday, April 10, 2024 at 8:51:01 AM

Updated on: Wednesday, May 28, 2025 at 5:06:20 PM

Vector type: XSS

Vector charset: UTF-8

Template used:
<a href="$[chr]javascript:test.com/" id="test"></a>

Code used after fuzz:
if(document.getElementById("test").protocol=="javascript:"){log($[i])}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a><a href=" javascript:test.com/" id="test"></a>

<a href="
javascript:test.com/" id="test"></a>

<a href="javascript:test.com/" id="test"></a><a href="javascript:test.com/" id="test"></a>

<a href="
javascript:test.com/" id="test"></a>

Characters that can precede the javascript protocol

Sample payloads

Fuzz results