I came across this hack.me XSS challenge.

Solution to this challenge is:


I'm confused with %0A. Why does it not work with this payload?


It's required to terminate a Javascript comment.

The challenge enforces a link format along the lines of [a-z]*://.*. Here, the idea is to inject JS via the javascript: pseudo protocol. So, in order to adhere to the link format, you have to start your sequence with javascript://.

But since everything behind the colon is interpreted as JS, you run into a problem: // introduces a single-line comment in JS, so everything that comes after it will be commented out until a newline character appears. This will do nothing:


%0a is the URL-encoded version of an ASCII newline, so your payload effectively becomes this:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.