Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for
javascript:alert(0)
The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML.
<script>alert(0)</script>
But where does javascript:alert(0) come from? From my research colons are used for labeling anonymous functions and object literals but not sure if it's the same with this payload.
javascript: is the URI scheme (like http: or https: or ftp: or file:) for immediate-execution javascript. Javascript URIs can be set as the "URL" of a window, both the top-level window or an iframe/popup/etc. They execute in the context of the currently-loaded origin and page, so it's equivalent to injecting a script tag into the page.
Outside of malicious operations (such as excessively open redirects), javascript: URIs are usually used for "bookmarklets", where you create a bookmark in your browser that contains a little bit of script you might want to run on an arbitrary page. Then, when you're on the page, you can "go to" the bookmarklet, which just runs that script snippet on the page. An amusing example is featured on this page: http://kathack.com/
From a security perspective, javascript: URIs are usually not commonly used in attacks, but sometimes they're the most practical option. If you can control the location of a window, but nothing else, javascript: URIs are an option (along with data: URIs) for injecting arbitrary content into the page context. Most other times, it's easier to manipulate the actual HTML, though (by injecting a script tag, or an HTML element with event handlers, or changing the content of an existing JS block / invocation).
