- Home
- Vectors
  - Categories
  - All vectors
  - All collections
  - Browser diffs
  - RSS
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- What's new
- Help

Normalizing...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

String trim whitepace characters
Decimal separators in parseFloat
URL fuzzing SVG before href attribute
Before URL protocol relative characters
CSS Properties that make external requests
CSS escapes that cause an external request with a forward slash
Characters that are valid JS part variables
Supported SVG by the Sanitizer
Characters that are treated as spaces
Supported MathML by the Sanitizer
HTML tag localName differences
Characters ignored in hostname before port in URL constructor
Characters ignored after hostname in URL constructor
Characters ignored after colon in URL constructor
URL slash alternatives
URL question mark alternatives
URL hash alternatives
Characters that act as slashes in anchors
Characters that act as hash in anchors
Characters that act as question mark in anchors

New collections

Fetch with protocol relative URLs
CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

Supported SVG by the Sanitizer
Supported MathML by the Sanitizer
Supported HTML by the Sanitizer
HTML sanitizer support
Tags that consume markup but select consumes them
Characters after protocol relative slashes in fetch()
Characters in-between protocol relative URLs in fetch()
Characters before protocol relative URLs in fetch()
Script tag closing characters
Attribute separators

Most Popular

URL domain dot alternatives(9.4k)
Characters allowed javascript and colon(8.1k)
JavaScript Scheme starting with https://(7.5k)
Characters between < and element name(7k)
Characters allowed between hostname and / but don't change the hostname(6.5k)
HTML entities that create ASCII characters inside a JavaScript URL(6.4k)
DOM element relationships(6.3k)
Characters that can precede the javascript protocol(6.2k)
characters allowed between exclamation mark and greater then (5.9k)
Entities that cause an external URL before @(5.8k)

Most Liked

URL domain dot alternatives(5)
Characters that can precede the javascript protocol(4)
Characters allowed between multiple HTML attributes(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between hostname and / but don't change the hostname(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Entities that cause an external URL before @(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

Shared disconnectedPersonalconnecting

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Personal networksign in

Log in on each browser you use and one press of Fuzz or Test fuzz runs the vector in all of them, with every browser's results side by side.

Sign in to get started

Newbie

rajeshchore7

Fuzzing...

Error!

<img src=x onerror=alert(87)>

@rajeshchore7

0 Vectors 0 Following 0 Followers

Posts Replies Likes Vectors

No followers yet.