I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a
href of an
anchor tag which causes the XSS attack.
In order to check for various ways in which XSS attack can be performed, I referred a Github document where I found the below code,
When the above code is inserted into the input field, the anchor tag becomes as follows:
<a target="_blank" rel="noopener" href="\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)">Sample Code</a>
On clicking the above link, an alert box pops up displaying
How is the above code parsed and run by the browser when the user clicks on it? I have read about escape sequences, but the above escape characters puts me in dilemma.