Characters allowed before the JavaScript protocol

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.

Created by: hackvertor

Created on: Thursday, January 16, 2025 at 7:22:56 PM

Updated on: Thursday, February 20, 2025 at 6:45:35 PM

Vector type: XSS

Vector charset: UTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>
<base href="https://example.com" />

Template used:
<a href="$[chr]javascript:" id=x></a>

Code used after fuzz:
x.protocol === 'javascript:' && log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href="javascript:" id=x></a><a href=" javascript:" id=x></a>

<a href="
javascript:" id=x></a>

<a href="javascript:" id=x></a><a href="javascript:" id=x></a>

<a href="
javascript:" id=x></a>

Characters allowed before the JavaScript protocol

Sample payloads

Fuzz results