Named Character References in URLs

Modern browsers turn HTML5 named character references into ASCII when used in URLs. This can be useful for bypasses and needs to be documented.

List of character references: https://developers.whatwg.org/named-character-references.html#named-character-references

Examples:

This sends you to //fi.org/ 
<a href="&sol;&sol;&filig;.org">CLICKME</a>

Now, even better - guess where that sends you to?
<a href="&sol;&sol;&Gopf;&Oscr;&order;&gscr;&Laplacetrf;&ee;.&complexes;&ofr;&Mellintrf;">CLICKME</a>

Crazy Examples:

This executes an alert on all tested browsers. Note the details!
<a href="javascript&colon;&apos;<script src=/&sol;&ETH;.pw&nvgt;</script&nvgt;&apos;">CLICK</a>

This looks like an alert(1) in Chrome. But it is none. URL and status bar are out of sync.
<a href="javascript:&aopf;&lscr;&efr;&rfr;&topf;(1)">CLICKME</a>

Firefox 39

//𝔄 resolves to http://a.org/
//𝔞 resolves to http://a.org/
//𝔸 resolves to http://a.org/
//𝕒 resolves to http://a.org/
//𝒜 resolves to http://a.org/
//𝒶 resolves to http://a.org/
//ℬ resolves to http://b.org/
//ℬ resolves to http://b.org/
//𝔅 resolves to http://b.org/
//𝔟 resolves to http://b.org/
//𝔹 resolves to http://b.org/
//𝕓 resolves to http://b.org/
//ℬ resolves to http://b.org/
//𝒷 resolves to http://b.org/
//ⅅ resolves to http://d.org/
//ℭ resolves to http://c.org/
//ℭ resolves to http://c.org/
//𝔠 resolves to http://c.org/
//Ⓢ resolves to http://s.org/
//ℂ resolves to http://c.org/
//ℂ resolves to http://c.org/
//𝕔 resolves to http://c.org/
//𝒞 resolves to http://c.org/
//𝒸 resolves to http://c.org/
//ⅅ resolves to http://d.org/
//ⅆ resolves to http://d.org/
//𝔇 resolves to http://d.org/
//𝔡 resolves to http://d.org/
//ⅆ resolves to http://d.org/
//𝔻 resolves to http://d.org/
//𝕕 resolves to http://d.org/
//𝒟 resolves to http://d.org/
//𝒹 resolves to http://d.org/
//ⅇ resolves to http://e.org/
//𝔈 resolves to http://e.org/
//𝔢 resolves to http://e.org/
//ℓ resolves to http://l.org/
//𝔼 resolves to http://e.org/
//𝕖 resolves to http://e.org/
//ℰ resolves to http://e.org/
//ℯ resolves to http://e.org/
//ℰ resolves to http://e.org/
//ⅇ resolves to http://e.org/
//ⅇ resolves to http://e.org/
//ffi resolves to http://ffi.org/
//ff resolves to http://ff.org/
//ffl resolves to http://ffl.org/
//𝔉 resolves to http://f.org/
//𝔣 resolves to http://f.org/
//fi resolves to http://fi.org/
//fj resolves to http://fj.org/
//fl resolves to http://fl.org/
//𝔽 resolves to http://f.org/
//𝕗 resolves to http://f.org/
//ℱ resolves to http://f.org/
//ℱ resolves to http://f.org/
//𝒻 resolves to http://f.org/
//𝔊 resolves to http://g.org/
//𝔤 resolves to http://g.org/
//𝔾 resolves to http://g.org/
//𝕘 resolves to http://g.org/
//𝒢 resolves to http://g.org/
//ℊ resolves to http://g.org/
//ℋ resolves to http://h.org/
//ℌ resolves to http://h.org/
//𝔥 resolves to http://h.org/
//ℋ resolves to http://h.org/
//ℍ resolves to http://h.org/
//𝕙 resolves to http://h.org/
//ℋ resolves to http://h.org/
//𝒽 resolves to http://h.org/
//ℑ resolves to http://i.org/
//𝔦 resolves to http://i.org/
//ⅈ resolves to http://i.org/
//IJ resolves to http://ij.org/
//ij resolves to http://ij.org/
//ℑ resolves to http://i.org/
//ℑ resolves to http://i.org/
//ⅈ resolves to http://i.org/
//ℐ resolves to http://i.org/
//ℑ resolves to http://i.org/
//ℤ resolves to http://z.org/
//𝕀 resolves to http://i.org/
//𝕚 resolves to http://i.org/
//ℐ resolves to http://i.org/
//𝒾 resolves to http://i.org/
//𝔍 resolves to http://j.org/
//𝔧 resolves to http://j.org/
//𝕁 resolves to http://j.org/
//𝕛 resolves to http://j.org/
//𝒥 resolves to http://j.org/
//𝒿 resolves to http://j.org/
//𝔎 resolves to http://k.org/
//𝔨 resolves to http://k.org/
//𝕂 resolves to http://k.org/
//𝕜 resolves to http://k.org/
//𝒦 resolves to http://k.org/
//𝓀 resolves to http://k.org/
//ℒ resolves to http://l.org/
//ℒ resolves to http://l.org/
//𝔏 resolves to http://l.org/
//𝔩 resolves to http://l.org/
//𝕃 resolves to http://l.org/
//𝕝 resolves to http://l.org/
//ℒ resolves to http://l.org/
//𝓁 resolves to http://l.org/
//ℳ resolves to http://m.org/
//𝔐 resolves to http://m.org/
//𝔪 resolves to http://m.org/
//𝕄 resolves to http://m.org/
//𝕞 resolves to http://m.org/
//ℳ resolves to http://m.org/
//𝓂 resolves to http://m.org/
//ℕ resolves to http://n.org/
//𝔑 resolves to http://n.org/
//𝔫 resolves to http://n.org/
//ℕ resolves to http://n.org/
//𝕟 resolves to http://n.org/
//𝒩 resolves to http://n.org/
//𝓃 resolves to http://n.org/
//№ resolves to http://no.org/
//𝔒 resolves to http://o.org/
//𝔬 resolves to http://o.org/
//𝕆 resolves to http://o.org/
//𝕠 resolves to http://o.org/
//ℴ resolves to http://o.org/
//ℴ resolves to http://o.org/
//ª resolves to http://a.org/
//º resolves to http://o.org/
//Ⓢ resolves to http://s.org/
//𝒪 resolves to http://o.org/
//ℴ resolves to http://o.org/
//𝔓 resolves to http://p.org/
//𝔭 resolves to http://p.org/
//ℳ resolves to http://m.org/
//ℎ resolves to http://h.org/
//ℌ resolves to http://h.org/
//ℙ resolves to http://p.org/
//𝕡 resolves to http://p.org/
//ℙ resolves to http://p.org/
//𝒫 resolves to http://p.org/
//𝓅 resolves to http://p.org/
//𝔔 resolves to http://q.org/
//𝔮 resolves to http://q.org/
//ℚ resolves to http://q.org/
//𝕢 resolves to http://q.org/
//𝒬 resolves to http://q.org/
//𝓆 resolves to http://q.org/
//ℍ resolves to http://h.org/
//ℚ resolves to http://q.org/
//ℜ resolves to http://r.org/
//ℜ resolves to http://r.org/
//ℛ resolves to http://r.org/
//ℜ resolves to http://r.org/
//ℝ resolves to http://r.org/
//ℜ resolves to http://r.org/
//𝔯 resolves to http://r.org/
//ℝ resolves to http://r.org/
//𝕣 resolves to http://r.org/
//ℛ resolves to http://r.org/
//𝓇 resolves to http://r.org/
//𝔖 resolves to http://s.org/
//𝔰 resolves to http://s.org/
//𝕊 resolves to http://s.org/
//𝕤 resolves to http://s.org/
//𝒮 resolves to http://s.org/
//𝓈 resolves to http://s.org/
//ß resolves to http://ss.org/
//𝔗 resolves to http://t.org/
//𝔱 resolves to http://t.org/
//𝕋 resolves to http://t.org/
//𝕥 resolves to http://t.org/
//™ resolves to http://tm.org/
//™ resolves to http://tm.org/
//𝒯 resolves to http://t.org/
//𝓉 resolves to http://t.org/
//𝔘 resolves to http://u.org/
//𝔲 resolves to http://u.org/
//𝕌 resolves to http://u.org/
//𝕦 resolves to http://u.org/
//𝒰 resolves to http://u.org/
//𝓊 resolves to http://u.org/
//𝔙 resolves to http://v.org/
//𝔳 resolves to http://v.org/
//𝕍 resolves to http://v.org/
//𝕧 resolves to http://v.org/
//𝒱 resolves to http://v.org/
//𝓋 resolves to http://v.org/
//𝔚 resolves to http://w.org/
//𝔴 resolves to http://w.org/
//𝕎 resolves to http://w.org/
//𝕨 resolves to http://w.org/
//𝒲 resolves to http://w.org/
//𝓌 resolves to http://w.org/
//𝔛 resolves to http://x.org/
//𝔵 resolves to http://x.org/
//𝕏 resolves to http://x.org/
//𝕩 resolves to http://x.org/
//𝒳 resolves to http://x.org/
//𝓍 resolves to http://x.org/
//𝔜 resolves to http://y.org/
//𝔶 resolves to http://y.org/
//𝕐 resolves to http://y.org/
//𝕪 resolves to http://y.org/
//𝒴 resolves to http://y.org/
//𝓎 resolves to http://y.org/
//ℨ resolves to http://z.org/
//ℨ resolves to http://z.org/
//𝔷 resolves to http://z.org/
//ℤ resolves to http://z.org/
//𝕫 resolves to http://z.org/
//𝒵 resolves to http://z.org/
//𝓏 resolves to http://z.org/

Chrome 44:

//𝔄 resolves to http://a.org/
//𝔞 resolves to http://a.org/
//𝔸 resolves to http://a.org/
//𝕒 resolves to http://a.org/
//𝒜 resolves to http://a.org/
//𝒶 resolves to http://a.org/
//ℬ resolves to http://b.org/
//ℬ resolves to http://b.org/
//𝔅 resolves to http://b.org/
//𝔟 resolves to http://b.org/
//𝔹 resolves to http://b.org/
//𝕓 resolves to http://b.org/
//ℬ resolves to http://b.org/
//𝒷 resolves to http://b.org/
//ⅅ resolves to http://d.org/
//ℭ resolves to http://c.org/
//ℭ resolves to http://c.org/
//𝔠 resolves to http://c.org/
//Ⓢ resolves to http://s.org/
//ℂ resolves to http://c.org/
//ℂ resolves to http://c.org/
//𝕔 resolves to http://c.org/
//𝒞 resolves to http://c.org/
//𝒸 resolves to http://c.org/
//ⅅ resolves to http://d.org/
//ⅆ resolves to http://d.org/
//𝔇 resolves to http://d.org/
//𝔡 resolves to http://d.org/
//ⅆ resolves to http://d.org/
//𝔻 resolves to http://d.org/
//𝕕 resolves to http://d.org/
//𝒟 resolves to http://d.org/
//𝒹 resolves to http://d.org/
//ⅇ resolves to http://e.org/
//𝔈 resolves to http://e.org/
//𝔢 resolves to http://e.org/
//ℓ resolves to http://l.org/
//𝔼 resolves to http://e.org/
//𝕖 resolves to http://e.org/
//ℰ resolves to http://e.org/
//ℯ resolves to http://e.org/
//ℰ resolves to http://e.org/
//ⅇ resolves to http://e.org/
//ⅇ resolves to http://e.org/
//ffi resolves to http://ffi.org/
//ff resolves to http://ff.org/
//ffl resolves to http://ffl.org/
//𝔉 resolves to http://f.org/
//𝔣 resolves to http://f.org/
//fi resolves to http://fi.org/
//fj resolves to http://fj.org/
//fl resolves to http://fl.org/
//𝔽 resolves to http://f.org/
//𝕗 resolves to http://f.org/
//ℱ resolves to http://f.org/
//ℱ resolves to http://f.org/
//𝒻 resolves to http://f.org/
//𝔊 resolves to http://g.org/
//𝔤 resolves to http://g.org/
//𝔾 resolves to http://g.org/
//𝕘 resolves to http://g.org/
//𝒢 resolves to http://g.org/
//ℊ resolves to http://g.org/
//ℋ resolves to http://h.org/
//ℌ resolves to http://h.org/
//𝔥 resolves to http://h.org/
//ℋ resolves to http://h.org/
//ℍ resolves to http://h.org/
//𝕙 resolves to http://h.org/
//ℋ resolves to http://h.org/
//𝒽 resolves to http://h.org/
//ℑ resolves to http://i.org/
//𝔦 resolves to http://i.org/
//ⅈ resolves to http://i.org/
//IJ resolves to http://ij.org/
//ij resolves to http://ij.org/
//ℑ resolves to http://i.org/
//ℑ resolves to http://i.org/
//ⅈ resolves to http://i.org/
//ℐ resolves to http://i.org/
//ℑ resolves to http://i.org/
//ℤ resolves to http://z.org/
//𝕀 resolves to http://i.org/
//𝕚 resolves to http://i.org/
//ℐ resolves to http://i.org/
//𝒾 resolves to http://i.org/
//𝔍 resolves to http://j.org/
//𝔧 resolves to http://j.org/
//𝕁 resolves to http://j.org/
//𝕛 resolves to http://j.org/
//𝒥 resolves to http://j.org/
//𝒿 resolves to http://j.org/
//𝔎 resolves to http://k.org/
//𝔨 resolves to http://k.org/
//𝕂 resolves to http://k.org/
//𝕜 resolves to http://k.org/
//𝒦 resolves to http://k.org/
//𝓀 resolves to http://k.org/
//ℒ resolves to http://l.org/
//ℒ resolves to http://l.org/
//𝔏 resolves to http://l.org/
//𝔩 resolves to http://l.org/
//𝕃 resolves to http://l.org/
//𝕝 resolves to http://l.org/
//ℒ resolves to http://l.org/
//𝓁 resolves to http://l.org/
//ℳ resolves to http://m.org/
//𝔐 resolves to http://m.org/
//𝔪 resolves to http://m.org/
//𝕄 resolves to http://m.org/
//𝕞 resolves to http://m.org/
//ℳ resolves to http://m.org/
//𝓂 resolves to http://m.org/
//ℕ resolves to http://n.org/
//𝔑 resolves to http://n.org/
//𝔫 resolves to http://n.org/
//ℕ resolves to http://n.org/
//𝕟 resolves to http://n.org/
//𝒩 resolves to http://n.org/
//𝓃 resolves to http://n.org/
//№ resolves to http://no.org/
//𝔒 resolves to http://o.org/
//𝔬 resolves to http://o.org/
//𝕆 resolves to http://o.org/
//𝕠 resolves to http://o.org/
//ℴ resolves to http://o.org/
//ℴ resolves to http://o.org/
//ª resolves to http://a.org/
//º resolves to http://o.org/
//Ⓢ resolves to http://s.org/
//𝒪 resolves to http://o.org/
//ℴ resolves to http://o.org/
//𝔓 resolves to http://p.org/
//𝔭 resolves to http://p.org/
//ℳ resolves to http://m.org/
//ℎ resolves to http://h.org/
//ℌ resolves to http://h.org/
//ℙ resolves to http://p.org/
//𝕡 resolves to http://p.org/
//ℙ resolves to http://p.org/
//𝒫 resolves to http://p.org/
//𝓅 resolves to http://p.org/
//𝔔 resolves to http://q.org/
//𝔮 resolves to http://q.org/
//ℚ resolves to http://q.org/
//𝕢 resolves to http://q.org/
//𝒬 resolves to http://q.org/
//𝓆 resolves to http://q.org/
//ℍ resolves to http://h.org/
//ℚ resolves to http://q.org/
//ℜ resolves to http://r.org/
//ℜ resolves to http://r.org/
//ℛ resolves to http://r.org/
//ℜ resolves to http://r.org/
//ℝ resolves to http://r.org/
//ℜ resolves to http://r.org/
//𝔯 resolves to http://r.org/
//ℝ resolves to http://r.org/
//𝕣 resolves to http://r.org/
//ℛ resolves to http://r.org/
//𝓇 resolves to http://r.org/
//𝔖 resolves to http://s.org/
//𝔰 resolves to http://s.org/
//𝕊 resolves to http://s.org/
//𝕤 resolves to http://s.org/
//𝒮 resolves to http://s.org/
//𝓈 resolves to http://s.org/
//ß resolves to http://ss.org/
//𝔗 resolves to http://t.org/
//𝔱 resolves to http://t.org/
//𝕋 resolves to http://t.org/
//𝕥 resolves to http://t.org/
//™ resolves to http://tm.org/
//™ resolves to http://tm.org/
//𝒯 resolves to http://t.org/
//𝓉 resolves to http://t.org/
//𝔘 resolves to http://u.org/
//𝔲 resolves to http://u.org/
//𝕌 resolves to http://u.org/
//𝕦 resolves to http://u.org/
//𝒰 resolves to http://u.org/
//𝓊 resolves to http://u.org/
//𝔙 resolves to http://v.org/
//𝔳 resolves to http://v.org/
//𝕍 resolves to http://v.org/
//𝕧 resolves to http://v.org/
//𝒱 resolves to http://v.org/
//𝓋 resolves to http://v.org/
//𝔚 resolves to http://w.org/
//𝔴 resolves to http://w.org/
//𝕎 resolves to http://w.org/
//𝕨 resolves to http://w.org/
//𝒲 resolves to http://w.org/
//𝓌 resolves to http://w.org/
//𝔛 resolves to http://x.org/
//𝔵 resolves to http://x.org/
//𝕏 resolves to http://x.org/
//𝕩 resolves to http://x.org/
//𝒳 resolves to http://x.org/
//𝓍 resolves to http://x.org/
//𝔜 resolves to http://y.org/
//𝔶 resolves to http://y.org/
//𝕐 resolves to http://y.org/
//𝕪 resolves to http://y.org/
//𝒴 resolves to http://y.org/
//𝓎 resolves to http://y.org/
//ℨ resolves to http://z.org/
//ℨ resolves to http://z.org/
//𝔷 resolves to http://z.org/
//ℤ resolves to http://z.org/
//𝕫 resolves to http://z.org/
//𝒵 resolves to http://z.org/
//𝓏 resolves to http://z.org/

MSIE11 / Edge

//fj resolves to http://fj.org/

Wait. that is all? No.

Note that things in MSIE / Edge are a bit weird. Because the DOM doesn't actually reflect the ASCII URL but still shows the Unicode value! But once the URL is actually being used (a link being clicked, a script being fetched) the ASCII value is used nevertheless.

Example:

<a href="//&Afr;.org">CLICKME</a>

// document.links[0].href shows "http://𝔄.org/"
// But once you click the link, you'll be sent to "a.org"