Characters allowed javascript and colon copy2

⚠ Browser differences

Vector to check if any characters are allowed between javascript and : to still result in a javascript url.

Novice Fuzzer

Created Sep 29, 2024

Updated May 28, 2025

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("javascript"+String.fromCodePoint(parseInt($[i]..toString(16),16))+":alert()").protocol=="javascript:"){log($[i])}

Sample payloads

if (new URL("javascript"+String.fromCodePoint(parseInt(0..toString(16),16))+":alert()").protocol=="javascript:"){alert(0)}

if (new URL("javascript"+String.fromCodePoint(parseInt(9..toString(16),16))+":alert()").protocol=="javascript:"){alert(9)}

if (new URL("javascript"+String.fromCodePoint(parseInt(10..toString(16),16))+":alert()").protocol=="javascript:"){alert(10)}

if (new URL("javascript"+String.fromCodePoint(parseInt(13..toString(16),16))+":alert()").protocol=="javascript:"){alert(13)}

if (new URL("javascript"+String.fromCodePoint(parseInt(58..toString(16),16))+":alert()").protocol=="javascript:"){alert(58)}