I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after a slash gets deleted.

I've tried things such as <script\src=*>, but you'd need a forward slash to make it work from my understanding.

  • Are non-space white space characters such as tabs or line breaks allowed? – Rob W Dec 27 '13 at 0:42
  • I tried a tab just a bit ago and it was deleted. It's in a URL, so I'm not sure if a line break would work unless it was encoded. – Michael Blake Dec 27 '13 at 0:48
  • 2
    look at the IE xss filter bypasses by whitehat. – rook Dec 27 '13 at 7:04
  • XSS works differently depending on what context you are injecting into (attribute value, script, between tags, etc). Please include that in your question. – Anders Jun 29 '16 at 16:57

No space ... No Slash :


See how it runs here: http://jsfiddle.net/23sqP/3/

  • That is nicely done. That probably will work! – Karthik Rangarajan Dec 31 '13 at 1:27
  • What sign is that supposed to be between svg and onload? When I copy it from here, it doesn't work. When I copy it from the URL you provided it does work. But what unicode character is it exactly? My impression is, that as soon as I copy it, it changes its format. – user857990 Aug 27 '15 at 12:07
  • 2
    Doesn't work for me in the latest version of chrome. – gsingh2011 Sep 26 '15 at 5:30
  • 5
    That character is the "Form Feed" character, hex 0c, decimal 12. en.wikipedia.org/wiki/Page_break#Form_feed – Mark Stewart Jun 27 '16 at 17:32

It's hard to come up with a vector without having the actual vulnerability in front of me, but in the past, when I've faced such problems, I've gone the non-alphanumeric way to exploit it. This blog has an excellent description of how it is done. A few vectors are in this pastie as well.

I'm going to assume you have a way to execute scripts, but you just need the correct payload to execute. From the blog referenced above:

Since JavaScript has two different syntactic forms to access properties, you can access an Object method like a dictionary:

object.method(arguments) === object["method"](arguments)

So going with this method, your payload could then be something like:


If you want to pull out the cookie, you could also use


Using either of these methods should hopefully get you the code execution you're looking for. These don't have spaces or slashes - thought you would still need to be within an attribute of some sort, or you should have the ability to enclose it in <script> tags. In some browsers, you could try something like <script>{your vector}<script>, and it might work (I remember it working for me on IE a while ago)

EDIT: If this is just a proof of concept for an input validation vulnerability, you could also embed an iFrame. Again, depending on the browser, iFrames don't need closing tags. so <iframe\src='www.google.com'> might just do the job.

  • Thank you for the reply and the informative information, but like you said, you'd still need a closing script tag for it to work. – Michael Blake Dec 27 '13 at 1:22
  • Sorry, just saw your edit. I just tried it with two opening tags in IE and it didn't seem to work. It might be because IE is encoding my URL. Also, I don't know if it makes a difference, but it's DOM XSS. – Michael Blake Dec 27 '13 at 1:29
  • Would it be possible at all to include the point of injection? That would definitely make the job easier. Sanitize whatever you think is necessary, but just the gist of where the injection is would make it easier to attack. Also, I added another edit where you could use an iframe, but if it's DOM based, it might not work. – Karthik Rangarajan Dec 27 '13 at 1:31
  • I think this is what you're asking for prntscr.com/2e84kc The injection point is a pathname, so http://example.com/injectionhere Also, I tried your iFrame, but it looks like the backslash was URL encoded. – Michael Blake Dec 27 '13 at 1:37
  • 1
    So I tried recreating the JS that you gave to try attacks; it looks like they're doing something in addition to whatever it is that jQuery does to do the HTML encoding of space, and TAB. When I provide a space, it seems to work the way I expect it to. I would suggest looking into that filter to see if you can bypass it. Also, evals won't work. :) – Karthik Rangarajan Dec 28 '13 at 22:10

I know I'm a little late to the party, but there's another effective vector. Encoding the payload. Here's a sample payload that triggers an alert:


The jsfiddle is here. No spaces, no nothing. The payload is made up of six characters, ![]+(). No spaces involved.

You can encode the payload using this tool.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.