- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help
- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help

Hacking...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

CSS hex escapes that cause an external request in-between forward slashes
CSS Properties and functions that make external requests
SVG elements & attributes that make external requests
Characters between element name and >
JavaScript separators between function names
Characters allowed after parentheses
Characters allowed before parentheses
Characters that act like new line or single line comment
Characters after strings
HTML comment before greater than
Characters that act as quotes or whitespace
Characters that can break out of a single line comment
Characters that can be inserted in the middle of the JS protocol name
Characters that change length on .toLowerCase()
Break out of CSS strings
Characters allowed in-between hyphens
Characters allowed as a class separator
Characters that change length on .toUpperCase()
Characters allowed between an object and the dot operator
characters after slash that make a http protocol

New collections

CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

Characters before CSS property values
Characters in-between CSS property names
Test chars in js protocol
URL fuzzing SVG before href attribute
URL fuzzing attributes
character between url and ( for import
HTML tagName differences
HTML tag localName differences
JavaScript URLs allowed by the Sanitizer
Supported HTML and events by the Sanitizer

Most Popular

URL domain dot alternatives(8.2k)
Characters allowed javascript and colon(7.5k)
JavaScript Scheme starting with https://(7.1k)
Characters allowed between hostname and / but don't change the hostname(6.2k)
Characters between < and element name(6.1k)
HTML entities that create ASCII characters inside a JavaScript URL(6k)
DOM element relationships(6k)
Characters that can precede the javascript protocol(5.9k)
characters allowed between exclamation mark and greater then (5.4k)
Characters allowed javascript and colon copy2(5.3k)

Most Liked

URL domain dot alternatives(5)
Characters that can precede the javascript protocol(4)
Characters allowed between multiple HTML attributes(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between hostname and / but don't change the hostname(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Entities that cause an external URL before @(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Shazzer Master

hackvertor

Fuzzing...

Error!

Gareth Heyes

@hackvertor

Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor.

garethheyes.co.uk/#latestBook

160 Vectors 26 Following 46 Followers

Posts Replies Likes Vectors

hackvertor 17d ago

@guusec External requests will be blocked. You need to use url fuzzing placeholders e.g shazzer.co.uk/help#url-fuzzing

hackvertor 1mo ago

@hackvertor You can view stats for various sections too shazzer.co.uk/stats/performance

hackvertor 2mo ago

@amirjoudak Can you make your test vectors private please instead of public.

hackvertor 3mo ago

@renniepak Hey :) it needs testing but basic stuff works