HTML entities inside JavaScript URL



Shows which HTML entities are allowed inside the JavaScript protocol
Created by: hackvertor
Created on: Tuesday, June 25, 2024 at 11:56:40 AM
Updated on: Monday, February 10, 2025 at 9:37:23 AM
Vector type: JS
Vector charset: UTF-8
Code used before fuzz:
const div = document.createElement('div');
Template used:
div.innerHTML='<a href="java$[data1]script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && log('$[data1]')
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
div.innerHTML='<a href="java	script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('	')
div.innerHTML='<a href="java
script:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('
')
Fuzz results

Chrome 126.0.0.0 desktop macOS 10.15.7
Updated
Tue Jun 25 2024
Found 2 results
Loading...

Firefox 127.0 desktop macOS 10.15
Updated
Tue Jun 25 2024
Found 2 results
Loading...

Safari 17.4 desktop macOS 10.15.7
Updated
Tue Jun 25 2024
Found 2 results
Loading...