The string location.href = javascript:window.location='https://evil.com';// is a classic JavaScript-URI injection payload. It is not a product name, a part number, or a hardware specification — it is a snippet of attack code that appears in security audits, penetration-test reports and bug-bounty disclosures. When a vulnerable web page or application accepts this text as user input and later reflects it into an HTML context without proper encoding, the browser interprets the javascript: scheme as executable script rather than inert text. The script then reassigns window.location, forcing the browser to navigate away to an attacker-controlled host.
How the Payload Works, Step by Step
The payload has three distinct parts, and each one matters for how you defend against it. location.href = ... is the assignment target: it changes the current document's address. javascript: is a URI scheme that browsers treat as an instruction to execute the text that follows, rather than fetch
