HTML entities inside JavaScript URL
2
2
2Shows which HTML entities are allowed inside the JavaScript protocol
Created by: hackvertor
Created on: Tuesday, June 25, 2024 at 11:56:40 AM
Updated on: Saturday, November 30, 2024 at 4:17:37 AM
Vector type: JS
Vector charset: UTF-8
Code used before fuzz:
const div = document.createElement('div');Template used:
div.innerHTML='<a href="java$[data1]script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && log('$[data1]')Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
div.innerHTML='<a href="java	script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('	')div.innerHTML='<a href="java
script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('
')Fuzz results
Chrome 126.0.0.0 desktop macOS 10.15.7
Updated
Tue Jun 25 2024
Found 2 results
Loading...
Firefox 127.0 desktop macOS 10.15
Updated
Tue Jun 25 2024
Found 2 results
Loading...
Safari 17.4 desktop macOS 10.15.7
Updated
Tue Jun 25 2024
Found 2 results
Loading...