Entities that cause an external URL before @

This vector shows what entities cause an external URL when used before an @

Created by: hackvertor

Created on: Wednesday, September 25, 2024 at 7:57:28 AM

Updated on: Wednesday, May 28, 2025 at 5:06:19 PM

Detecting browser...

Category: Entity Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Vector data 1: html_entities

Code used before fuzz:

const div = document.createElement('div');

Template used:

div.innerHTML=`<a href="https://psres.net$[data1]@example.com" id=x>test</a>`;

Code used after fuzz:

if(x.host !== 'example.com') {0x0D
   log('$[data1]');0x0D
}

Sample payloads

div.innerHTML=`<a href="https://psres.net&bsol;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&num;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&quest;@example.com" id=x>test</a>`;

div.innerHTML=`<a href="https://psres.net&sol;@example.com" id=x>test</a>`;