I came across this hack.me XSS challenge.

Solution to this challenge is:


I'm confused with %0A. Why does it not work with this payload?


1 Answer 1


It's required to terminate a Javascript comment.

The challenge enforces a link format along the lines of [a-z]*://.*. Here, the idea is to inject JS via the javascript: pseudo protocol. So, in order to adhere to the link format, you have to start your sequence with javascript://.

But since everything behind the colon is interpreted as JS, you run into a problem: // introduces a single-line comment in JS, so everything that comes after it will be commented out until a newline character appears. This will do nothing:


%0a is the URL-encoded version of an ASCII newline, so your payload effectively becomes this:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .