Entities that cause an external URL before @

This vector shows what entities cause an external URL when used before an @

Shazzer Master

Created Sep 25, 2024

Updated May 28, 2025

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

const div = document.createElement('div');

Template used:

div.innerHTML=`<a href="https://psres.net$[data1]@example.com" id=x>test</a>`;

Code used after fuzz:

if(x.host !== 'example.com') {0x0D
   log('$[data1]');0x0D
}

Sample payloads

div.innerHTML=`<a href="https://psres.net&bsol;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&num;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&quest;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&sol;@example.com" id=x>test</a>`;