I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag.

1 )When I set payload to javascript:alert()(which is the only payload I can think of in this context), it is reflected as <a href="http://javascript:alert(1)"

2) If the input payload is


The reflected output is <a href="http://javascript://%0aalert(1);//" and when clicked opens as http://javascript//%0aalert(1);// .

Is any bypass possible in this context?

  • 3
    put the code you want to run on a server and enter that address as the payload? – schroeder Jan 11 '16 at 21:28

No, if you can't change the part before the colon, you are guaranteed to always produce a HTTP URL, no matter what you append.

This follows the Uniform Resource Identifier (URI): Generic Syntax RFC 3986.

Each URI begins with a scheme name [...].

The syntax of the scheme part is specified as follows:

URI  = scheme ":" hier-part [ "?" query ] [ "#" fragment ]

So, no XSS is possible here and you are limited to comparatively harmless vulnerability classes, which deal with HTTP URLs, such as open redirects or referer leakages - depending on your scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.