New answers tagged


A URL (Uniform Resource Locator) in general is compose of the destination host and the URI (Uniform Resorce Identifier). The URI can contains whatever, a string with delimiters /, a base64 encoding, a binary exploit, sql injections, and so on. The URI processing depends on the implementation of the server, having said this, in general web servers process the ...


Not that I know of, but there are vulnerabilities in URL parsing, for example uXSS CVE-2018-6128. Basically on chrome on ios you could change the url state with JS and the browser domain origin check didnt work anymore, so you could XSS any bank or website through that.


Is there ANY way, an URL can run embedded JavaScript? A URL cannot run anything. A URL is just a string. How an URL can be used or abused depends on the context and application where it is used. Your specific case is about an XSS vulnerability in the web application where parts of the URL where embedded in the HTML page in a context which triggered the ...

Top 50 recent answers are included