Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Characters allowed after optional chaining
Characters in-between square brackets that close cdata
Entities allowed between slashes on a protocol relative URL
Tags that get reordered in the DOM
Entities allowed before slashes which result in an external URL
Tags that get moved out of parent
Characters allowed after slashes which result in an external URL
Characters allowed after colon which result in an external URL
Characters allowed between slashes using XSS type
Characters prepended to URL host. check if difference between URL and a tag
Entities allowed between slashes using XSS type
HTML TAGS Lists
Impossible lab frameset
HTML tags and attributes that can be used to access the URL
Allowed characters right after tag name & before tag closure, no other characters in between
Characters allowed after equals sign for event
Chars in href that will not default to full URL
document properties
Characters allowed between variable name and equals sign
Characters allowed instead of equal sign

URL domain dot alternatives(7.5k)
Characters allowed javascript and colon(7.3k)
JavaScript Scheme starting with https://(6.9k)
Characters allowed between hostname and / but don't change the hostname(6k)
Characters between < and element name(5.9k)
HTML entities that create ASCII characters inside a JavaScript URL(5.8k)
DOM element relationships(5.7k)
Characters that can precede the javascript protocol(5.7k)
characters allowed between exclamation mark and greater then (5.2k)
Characters allowed javascript and colon copy2(5.1k)

URL domain dot alternatives(5)
Characters that can precede the javascript protocol(4)
Characters allowed between multiple HTML attributes(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between hostname and / but don't change the hostname(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Entities that cause an external URL before @(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)