I am performing penetration testing on a web application. Let's say the site as "https://example.com"

There is a comment field , where a user can add data and it will be shown in the same page.

So I was trying multiple payloads all of them are filtered properly.

But this particular string produced something different in the page.

This is the string I entered : test

When I save this comment, it is being shown as hyperlink for the word "test" , the resulting hyperlink is this : https://example.com/normal.

If you observe, the text given in the square brackets is becoming the hyperlink by appending the text given in the normal brackets.

When we click on it , it is redirecting to the above URL (which is not a vulnerability)

When I inspected the element , it is shown like this

<a class="de-i" href="normal">test</a>

I have tried to exploit by giving javascript:alert(document.cookie) in the normal brackets but those are getting appended to the URL but not getting executed.

Are you aware of any bypasses and any reason why that pattern is rendered as a hyperlink.

Appreciate your inputs


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.