Injection in src attribute PORT, characters that change hostname

1

1

1

1

Injection in src attribute PORT, characters that change hostname

Created on: Sunday, June 15, 2025 at 6:15:55 PM

Updated on: Sunday, June 15, 2025 at 6:16:39 PM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

try{0x0D
img = document.createElement("img");0x0D
img.src=`https://example.com:1$[chr]1`;0x0D
url = new URL(img.src);0x0D
if(url.hostname != "example.com"){0x0D
  log($[i]);0x0D
}0x0D
} catch{}