All Collections
View collection
Collection3 vectors
Fetch with protocol relative URLs
Shows which characters are allowed in fetch() protocol relative URLs
Vectors
1.Characters in-between protocol relative URLs in fetch()2.Characters before protocol relative URLs in fetch()3.Characters after protocol relative slashes in fetch()
View collection
Collection19 vectors
CSS the bomb inside your inbox
This collection is all the vectors I used for my research CSS:the bomb inside your inbox. You can read about the research when released here: portswigger.net/research/css-the-bomb-inside-your-…
Vectors
1.Characters allowed as CSS variable names2.Characters allowed after !3.Invalid selector characters4.Invalid selector characters with a prefix of x5.Characters allowed before @import6.Characters allowed before url function with @import7.SVG elements & attributes that make external requests8.Characters before CSS property names9.CSS Properties that make external requests10.CSS Properties and functions that make external requests11.Characters allowed before image-set function12.Characters that close an @x prefix before @import13.Characters that close an @x with curlies prefix before @import14.CSS escapes that cause an external request with a forward slash15.CSS hex escapes that cause an external request in-between forward slashes16.Escaped characters that cause an external request in-between forward slashes17.CSS class name separators18.Characters before a CSS background url function19.Characters that break CSS dangling strings
View collection
Collection3 vectors
Characters ignored in URL constructors
Vectors
1.Characters ignored after colon in URL constructor2.Characters ignored after hostname in URL constructor3.Characters ignored in hostname before port in URL constructor
View collection
Collection4 vectors
Entities in protocol relative URLs
Vectors
1.Entities in-between protocol-relative URL2.Entities before protocol-relative URL3.relative & protocol relative url starting with a slash and not immediately having a slash after it.4.Entities after protocol-relative URL