Entities that cause an external URL before @

This vector shows what entities cause an external URL when used before an @

Created by: hackvertor

Created on: Wednesday, September 25, 2024 at 7:57:28 AM

Updated on: Friday, February 21, 2025 at 7:08:37 PM

Vector type: XSS

Vector charset: UTF-8

Vector data 1: html_entities

Code used before fuzz:
const div = document.createElement('div');

Template used:
div.innerHTML=`<a href="https://psres.net$[data1]@example.com" id=x>test</a>`;

Code used after fuzz:

if(x.host !== 'example.com') {
   log('$[data1]');
}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

div.innerHTML=`<a href="https://psres.net\@example.com" id=x>test</a>`;div.innerHTML=`<a href="https://psres.net&num;@example.com" id=x>test</a>`;div.innerHTML=`<a href="https://psres.net&quest;@example.com" id=x>test</a>`;div.innerHTML=`<a href="https://psres.net/@example.com" id=x>test</a>`;

Entities that cause an external URL before @

Sample payloads

Fuzz results