Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload
You can paste above payload in chrome URL bar to see that it executes.
[In above payload
// comments out code and
%0A takes the code outside of comment.] Here we have added stuffs between protocol and URL to execute xss.
I am trying to insert an arbitary letter,followed by(
//),followed by colon(
:) ahead of protocol (instead of between the protocol and URL as shown in example above) , something like:
But the above payload won't execute in chrome. Is there any workarounds for this?