- Home
- Vectors
  - Categories
  - All vectors
  - All collections
  - Browser diffs
  - RSS
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- What's new
- Help

NewShazzer now has an MCP server. Let Claude search, create and fuzz your vectors from Claude Desktop or Claude Code.Get an API key What's new

Shazzer blog

No posts found.

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

Supported SVG by the Sanitizer
Characters before CSS property names
Characters allowed before the JavaScript protocol colon
Escape inline double quote
Characters that starts element name
CSS inline property definition
Fuzzing for Max sanitized input (simplified)
Chars that can be used as opening bracket in innerHTML
Characters allowed in the protocol that still resolve host name
Characters that end unencapsulated HTML attribute values
Scheme slash alternatives in URL() when a base is used
Url parsing diff b/w anchor.href and new URL
Characters allowed before host name that are ignored
Characters allowed as a tag name using DOM APIs
Injection in src attribute PORT, characters that change hostname
Characters encoded by encodeURIComponent()
Characters encoded by encodeURI()
Characters encoded by escape()
encodeURI() not encoded with %
Characters allowed after throw statement

New collections

Fetch with protocol relative URLs
CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

Tags not rendered in MathML
Tags that break out of MathML
Supported SVG by the Sanitizer
Supported MathML by the Sanitizer
Supported HTML by the Sanitizer
HTML sanitizer support
Tags that consume markup but select consumes them
Characters after protocol relative slashes in fetch()
Characters in-between protocol relative URLs in fetch()
Characters before protocol relative URLs in fetch()

Most Popular

URL domain dot alternatives(9.6k)
Characters allowed javascript and colon(8.2k)
JavaScript Scheme starting with https://(7.7k)
Characters between < and element name(7.1k)
HTML entities that create ASCII characters inside a JavaScript URL(6.6k)
Characters allowed between hostname and / but don't change the hostname(6.6k)
DOM element relationships(6.5k)
Characters that can precede the javascript protocol(6.3k)
characters allowed between exclamation mark and greater then (6k)
Entities that cause an external URL before @(5.9k)

Most Liked

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

Shared disconnectedPersonalconnecting

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Personal networksign in

Log in on each browser you use and one press of Fuzz or Test fuzz runs the vector in all of them, with every browser's results side by side.

Sign in to get started