I came across this hack.me XSS challenge.
Solution to this challenge is:
I'm confused with
%0A. Why does it not work with this payload?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The challenge enforces a link format along the lines of
[a-z]*://.*. Here, the idea is to inject JS via the
But since everything behind the colon is interpreted as JS, you run into a problem:
// introduces a single-line comment in JS, so everything that comes after it will be commented out until a newline character appears. This will do nothing:
%0a is the URL-encoded version of an ASCII newline, so your payload effectively becomes this: