I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after a slash gets deleted.

I've tried things such as <script\src=*>, but you'd need a forward slash to make it work from my understanding.

  • Are non-space white space characters such as tabs or line breaks allowed? – Rob W Dec 27 '13 at 0:42
  • I tried a tab just a bit ago and it was deleted. It's in a URL, so I'm not sure if a line break would work unless it was encoded. – Michael Blake Dec 27 '13 at 0:48
  • 2
    look at the IE xss filter bypasses by whitehat. – rook Dec 27 '13 at 7:04
  • XSS works differently depending on what context you are injecting into (attribute value, script, between tags, etc). Please include that in your question. – Anders Jun 29 '16 at 16:57

No space, no slash:


The above should be a form feed character (0x0c), but SE does not allow it in posts. See how it runs here.

  • That is nicely done. That probably will work! – Karthik Rangarajan Dec 31 '13 at 1:27
  • What sign is that supposed to be between svg and onload? When I copy it from here, it doesn't work. When I copy it from the URL you provided it does work. But what unicode character is it exactly? My impression is, that as soon as I copy it, it changes its format. – user857990 Aug 27 '15 at 12:07
  • 2
    Doesn't work for me in the latest version of chrome. – gsingh2011 Sep 26 '15 at 5:30
  • 5
    That character is the "Form Feed" character, hex 0c, decimal 12. en.wikipedia.org/wiki/Page_break#Form_feed – Mark Stewart Jun 27 '16 at 17:32
  • That needs to be replace with 0x0c, but SE would strip it from the answer. – Arminius Feb 9 '20 at 0:09

It's hard to come up with a vector without having the actual vulnerability in front of me, but in the past, when I've faced such problems, I've gone the non-alphanumeric way to exploit it. This blog has an excellent description of how it is done. A few vectors are in this pastie as well.

I'm going to assume you have a way to execute scripts, but you just need the correct payload to execute. From the blog referenced above:

Since JavaScript has two different syntactic forms to access properties, you can access an Object method like a dictionary:

object.method(arguments) === object["method"](arguments)

So going with this method, your payload could then be something like:


If you want to pull out the cookie, you could also use


Using either of these methods should hopefully get you the code execution you're looking for. These don't have spaces or slashes - thought you would still need to be within an attribute of some sort, or you should have the ability to enclose it in <script> tags. In some browsers, you could try something like <script>{your vector}<script>, and it might work (I remember it working for me on IE a while ago)

EDIT: If this is just a proof of concept for an input validation vulnerability, you could also embed an iFrame. Again, depending on the browser, iFrames don't need closing tags. so <iframe\src='www.google.com'> might just do the job.

  • Thank you for the reply and the informative information, but like you said, you'd still need a closing script tag for it to work. – Michael Blake Dec 27 '13 at 1:22
  • Sorry, just saw your edit. I just tried it with two opening tags in IE and it didn't seem to work. It might be because IE is encoding my URL. Also, I don't know if it makes a difference, but it's DOM XSS. – Michael Blake Dec 27 '13 at 1:29
  • Would it be possible at all to include the point of injection? That would definitely make the job easier. Sanitize whatever you think is necessary, but just the gist of where the injection is would make it easier to attack. Also, I added another edit where you could use an iframe, but if it's DOM based, it might not work. – Karthik Rangarajan Dec 27 '13 at 1:31
  • 1
    So I tried recreating the JS that you gave to try attacks; it looks like they're doing something in addition to whatever it is that jQuery does to do the HTML encoding of space, and TAB. When I provide a space, it seems to work the way I expect it to. I would suggest looking into that filter to see if you can bypass it. Also, evals won't work. :) – Karthik Rangarajan Dec 28 '13 at 22:10
  • 1
    @MichaelBlake you could email me at myfirstname at isdpodcast dot com. If it's related to this, I would even suggest updating the question with the above screenshots and any new information you may have, so that people smarter than me can help. – Karthik Rangarajan Dec 29 '13 at 3:33

I know I'm a little late to the party, but there's another effective vector. Encoding the payload. Here's a sample payload that triggers an alert:


The jsfiddle is here. No spaces, no nothing. The payload is made up of six characters, ![]+(). No spaces involved.

You can encode the payload using this tool.

Not the answer you're looking for? Browse other questions tagged or ask your own question.