If a field is not santized(except <,>) and all it does is add http in payload and reflects the output, is it possible to execute script in the client side?

This is what output looks like for input ../javascript:alert(1)

<a href  = "http://../javascript:alert(1)" target ="_blank">

Another Sample input : Input : "><>:

Output :

<a href = "http://"&gt;&lt;:" target="_blank">

Edit: It would be nice if someone can think of payload with javascript: ,atrribute like a way to prompt using javascript:prompt(1).

  • All the http code is doing is completing the link source. You would have to trigger the link.
    – schroeder
    Oct 11, 2015 at 18:41
  • Any example you can come up with ? Oct 11, 2015 at 18:57

2 Answers 2


Because < and > are encoded, ending the anchor tag and adding a new tag won't work. However, if " quotation marks aren't encoded or filtered out, you can definitely still get XSS. For example, example.com/"+onclick="alert('XSS!') as a URL input will generate the output <a href="http://example.com/" onclick="alert('XSS!')" target="_blank">.

The onclick alert is the easiest way (EDIT: as @pineappleman points out), but you could also add other events (such as onmouseover) and could display your own content in front of the page using CSS, which could allow an attacker to influence victims into doing things that they would not want to do (think clickjacking, but on the vulnerable page directly instead of via an iframe of that page).

  • 1
    The quote is not encoded. However the entire thing is still considered a URL. For eg. for <a href="example.com/"onclick="alert('XSS!')"> and If I click, I get redirected to this URl => example.com/"onclick="alert('XSS!'). Oct 11, 2015 at 19:41
  • Did you miss the + (you could also do it with %20 in the URL) to create a space between the href and the onclick event handler? Of the href attribute value is quoted, as it ought to be, then that attack should work.
    – CBHacking
    Oct 11, 2015 at 19:46

If the data is not sanitized, but only "http" is added, than the app it's vulnerable to XSS. For example, if the data is inserted in a href attribute like this:

<a href="http://userdata">

then an attacker could instead of userdata enter "><img src=x onerror=alert() what would result in:

<a href="http://"><img src=x onerror=alert()">

Edit: In the second example you added, the < and > signs are encoded. You could try to insert " onclick="alert() what could execute a script when somebody clicks on the link.

  • Yes, Sorry for the confusion. Please read the question again. :) Oct 11, 2015 at 19:13
  • I added some info :) Oct 11, 2015 at 19:19
  • The edit says that quote is not filtered. Only > and < is filtered. Oct 11, 2015 at 19:20
  • Thanks again, the output is : <a href='http://"onclick = alert(1)' . Quote is not encoded, but the entire thing is considered a URL. Oct 11, 2015 at 19:29
  • try inserting a single quote (') instead of double qoute Oct 11, 2015 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .