Exp
<a href="javascr:{chr}ipt:alert(1)">:{i}</a><br/>
Callback
$$ x.innerHTML for x in document.links when x.protocol=="javascript:"
Start char
End char
Encode
None
Hex
Decimal
Escape
Fuzzing!