> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ar/web/xss/xss-with-blocked-events-and-href-attributes.md).

# XSS مع الأحداث المحظورة وخصائص href

### XSS منعكس مع معالجات الأحداث وسمات href محظور

المختبر د يجب أن تُدرِج العملية عنصرًا قابلًا للنقر يحمل الكلمات **"انقر"** (أو ما يعادله) وأن يفعّل `alert()` عند النقر.

أدرِج عنصرًا مرئيًا يحمل الكلمة **انقر على** الذي، عند نقر المستخدم عليه، ينفّذ `alert()` على الرغم من الحظر المفروض على مديري الأحداث و `href`.

```javascript
<script>
```

* إدراج `<script>` يعيد: *الوسم غير مسموح به*.

<figure><img src="/files/845cb4516fd478b63df58992146ca57cd325f4e8" alt=""><figcaption></figcaption></figure>

* الـ `<a>` الوسم مقبول (مثلاً `<a>test</a>`),

```javascript
<a>test</a>
```

<figure><img src="/files/015062a5ad4406feccd057e2bb9e07bf2772843c" alt="" width="510"><figcaption></figcaption></figure>

الـ `href` السمة مرفوضة — `href="JavaScript:..."` محظور.

```javascript
<a href="javascript:alert(0);"Click me</a>
```

<figure><img src="/files/ee187522270e1fe13249e4d9e73c3267e07a226e" alt=""><figcaption></figcaption></figure>

* عناصر SVG مسموح بها (`<svg>` مقبول).

```javascript
<svg>
```

<figure><img src="/files/00754c2ee747322e6251fbe42a1f5229c233fab6" alt="" width="563"><figcaption></figcaption></figure>

* عناصر تحريك SVG (مثل `<animate>`) تبدو موجودة وقابلة للاستغلال.

<figure><img src="/files/49198205f2feaa678d1cb856fbf2d42673be75d7" alt=""><figcaption></figcaption></figure>

**محاولات —**

* حقن `<script>` → مرفوض.
* استخدم `<a href="JavaScript:...">` → سمة محظورة.
* التفاف الحظر عبر دمج عناصر SVG وعناصر التحريك لنقل `href` قيمة إلى عنصر ربط وبالتالي محاولة تشغيل `JavaScript:alert(0)` عند النقر.

```javascript
<svg><a><animate attributeName=href values=javascript:alert(0) /><text x=30 y=30>انقرني!</script></a>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/ar/web/xss/xss-with-blocked-events-and-href-attributes.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.