HTML entities inside JavaScript URL

Shows which HTML entities are allowed inside the JavaScript protocol

Created by: hackvertor

Created on: 6/25/2024, 11:56:40 AM

Updated on: 7/14/2024, 6:51:56 PM

Vector type: JS

Code used before fuzz:
const div = document.createElement('div');
Template used:
div.innerHTML='<a href="java$[data1]script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && log('$[data1]')
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

div.innerHTML='<a href="java&Tab;script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('&Tab;')
div.innerHTML='<a href="java&NewLine;script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('&NewLine;')

Fuzz results

Chrome logo
Chrome 126.0.0.0 desktop macOS 10.15.7
Found 2 results
Data
&NewLine;
Data
&Tab;
Firefox logo
Firefox 127.0 desktop macOS 10.15
Found 2 results
Data
&NewLine;
Data
&Tab;
Safari logo
Safari 17.4 desktop macOS 10.15.7
Found 2 results
Data
&NewLine;
Data
&Tab;