- Home
- Login
- Vectors
- Help
- Home
- Login
- Vectors
- Help

Shazzer
Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes
Follow me on Twitter: @garethheyes

If you liked this, you may also like Hackvertor

New users

Snow1nd edwinabc gfrooo1989 bendtheory greg-bookyrslf skie2 monir832 cure53-s1r1us Cillian-Collins frevadiscor sinabehrsi richardcurteis ghost-Xy qhung98 ukusormus rafalafa729 martintw123 Macaroni4827 nytemart dellnull

Popular users

hackvertor (26)joaxcar (5)renniepak (4)masatokinugawa (3)JorianWoltjer (2)albinowax (2)0x999-x (2)d0ge (1)freddyb (1)ThomasOrlita (1)DreyAnd (1)K4r1it0 (1)securaji (1)InsertScript (1)koto (1)B-i-t-K (1)sqjor (1)ola456 (1)vitorfhc (1)weizman (1)

New vectors

Characters transformed when using lowercase Characters transformed when using uppercase Chars in href that will not default to full URL Non-standard characters that break JSON.parse()HTML elements that inherit properties which return the full URL URL scheme separator alternatives Characters that can be between < and script>Characters that cause the backslash to be consumed with GBK charset Characters that can precede the javascript protocol copy2 Characters allowed javascript and colon copy2 copy2 Characters that close or encapsulate HTML attribute values XSS vectors that consume tag HTML tags and attributes that can be used to access the URL HTML tags that can clobber the credentials part of the URL Characters that cause the backslash to be consumed with a big5 charset Differences between escape vs encodeURIComponent < removal bypass Entities in-between square brackets that close cdata Characters in-between square brackets that close cdata Includes Validation Chars Allowed

Most popular

URL domain dot alternatives (1183)DOM element relationships (1089)Characters between < and element name (1083)Characters allowed between hostname and / but don't change the hostname (1037)Characters that can precede the javascript protocol (1031)Characters allowed javascript and colon copy2 (1005)JavaScript Scheme starting with https:// (960)< removal bypass (890)characters allowed between exclamation mark and greater then (850)Characters allowed javascript and colon (828)Character that closes HTML tag (794)Includes Validation Chars Allowed (782)Characters that close or encapsulate HTML attribute values (765)All properties on navigator (two levels of nesting deep) (761)Characters allowed after hostname but don't change the hostname (716)HTML entities that create ASCII characters inside a JavaScript URL (669)work (654)Entities that cause an external URL before @ (641)Differences between escape vs encodeURIComponent (631)Characters that cause exceptions when URL encoded (621)

Most liked

Entities that cause an external URL before @ (4)JavaScript Scheme starting with https:// (4)URL domain dot alternatives (4)Characters allowed between hostname and / but don't change the hostname (4)HTML entities that create ASCII characters inside a JavaScript URL (2)HTML elements that are self closing or different text content (2)Characters allowed in-between operators (2)Characters that cause exceptions when URL encoded (2)Characters allowed javascript and colon (2)Characters allowed between multiple HTML attributes (2)Characters allowed after hostname but don't change the hostname (2)XSS vectors that consume tag (2)Characters that cause an external URL before @ (2)Characters that can precede the javascript protocol (2)Properties that contain URLs (2)HTML elements that parse differently when rendered (1)Characters that act as new lines in multi line strings (1)Entities allowed as JS variables (1)Characters that can break out of an inline style background-image url (1)Characters between < and element name (1)

sqjor

sqjor's profile

You are not following. Is not following you.

Followers: 1

Following: 0

Vectors 2

	Vector name	User	Created	Type	Likes
1 1 1	Characters allowed to end a JS string	sqjor	7/17/2024	JS	0
	Mutated XSS with img onerror	sqjor	7/30/2024	XSS	0