W1 scheme strip

It removes javascript: one time only. Nest it (javascjavascript:ript:alert(document.domain)) or use case/entities (JaVaScRiPt:, java	script:).

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only