3

I came across this hack.me XSS challenge.

Solution to this challenge is:

javascript://%0Aalert(1)

I'm confused with %0A. Why does it not work with this payload?

javascript://alert(1) 

1 Answer 1

6

It's required to terminate a Javascript comment.

The challenge enforces a link format along the lines of [a-z]*://.*. Here, the idea is to inject JS via the javascript: pseudo protocol. So, in order to adhere to the link format, you have to start your sequence with javascript://.

But since everything behind the colon is interpreted as JS, you run into a problem: // introduces a single-line comment in JS, so everything that comes after it will be commented out until a newline character appears. This will do nothing:

//alert(1)

%0a is the URL-encoded version of an ASCII newline, so your payload effectively becomes this:

//
alert(1)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .