Tweaks related to javascript execution in browser

Question

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload

javascript://%0D%0Aalert(document.domain);//validurl.com

You can paste above payload in chrome URL bar to see that it executes.

[In above payload // comments out code and %0A takes the code outside of comment.] Here we have added stuffs between protocol and URL to execute xss.

The problem: I am trying to insert an arbitary letter,followed by(//),followed by colon(:) ahead of protocol (instead of between the protocol and URL as shown in example above) , something like:

a://%0Ajavascript:alert(document.domain);

But the above payload won't execute in chrome. Is there any workarounds for this?

Answer 1

According to my test, I have found that the payload is valid but is not executing in Chrome. That is because of Chrome's browser based XSS protection. You need to turn it off so it will execute in Chrome. In Google Chrome, some XSS attacks are prevented using this protection. For disabling Google Chrome's XSS protection open it using the flag below:

googlechrome.exe --disable-xss-auditor

This will disable the XSS auditor of Chrome and the payload will work well.