Entities allowed before slashes which result in an external URL

4

4

4

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes entities before double slashes. It uses a base tag to get round the sandboxed iframe problems.

Created on: Thursday, January 16, 2025 at 7:20:57 PM

Updated on: Thursday, February 20, 2025 at 6:02:10 PM

Vector type: XSS

Vector charset: UTF-8

<script>window.onerror=x=>true;</script>
<base href="https://example.com" />

<a href="$[data1]//example2.com" id=x></a>

x.protocol === 'https:' && x.host === "example2.com" && log('$[data1]')