Confusing...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Tags that get reordered in the DOM
Characters that can be inside the javascript protocol
Tags that get moved out of parent
Tags that DO NOT support HTML comments
Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost
Chars allowed between src and = in img tag
Characters allowed before the JavaScript protocol colon
Escape inline double quote
Characters that starts element name
CSS inline property definition
Fuzzing for Max sanitized input (simplified)
Chars that can be used as opening bracket in innerHTML
Characters allowed in the protocol that still resolve host name
Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains
Characters that end unencapsulated HTML attribute values
Scheme slash alternatives in URL() when a base is used
Url parsing diff b/w anchor.href and new URL
Characters allowed before host name that are ignored
Characters allowed as a tag name using DOM APIs
Injection in src attribute PORT, characters that change hostname

URL domain dot alternatives(9.3k)
Characters allowed javascript and colon(8k)
JavaScript Scheme starting with https://(7.5k)
Characters between < and element name(6.9k)
Characters allowed between hostname and / but don't change the hostname(6.4k)
HTML entities that create ASCII characters inside a JavaScript URL(6.3k)
DOM element relationships(6.3k)
Characters that can precede the javascript protocol(6.1k)
characters allowed between exclamation mark and greater then (5.8k)
Entities that cause an external URL before @(5.8k)

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)