HTML entities inside JavaScript URL before colon
3
3
3Shows which HTML entities are allowed after colon with the JavaScript protocol
Created by: hackvertor
Created on: Tuesday, June 25, 2024 at 11:58:34 AM
Updated on: Friday, November 22, 2024 at 4:42:52 PM
Vector type: JS
Vector charset: UTF-8
Code used before fuzz:
const div = document.createElement('div');Template used:
div.innerHTML='<a href="javascript$[data1]:">test</a>';
div.querySelector('a').protocol === 'javascript:' && log('$[data1]')Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
div.innerHTML='<a href="javascript	:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('	')div.innerHTML='<a href="javascript
:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('
')div.innerHTML='<a href="javascript::">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert(':')Fuzz results
Safari 17.4 desktop macOS 10.15.7
Updated
Tue Jun 25 2024
Found 3 results
Loading...
Firefox 127.0 desktop macOS 10.15
Updated
Tue Jun 25 2024
Found 3 results
Loading...
Chrome 126.0.0.0 desktop macOS 10.15.7
Updated
Wed Jun 26 2024
Found 3 results
Loading...