- Home
- Vectors
- Network
- Tools
- Blog
  - Blog home
  - RSS
- Help
- Home
- Vectors
- Network
- Tools
- Blog
  - Blog home
  - RSS
- Help

Wiggling...

Shazzer
Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes
Follow me on Twitter: @garethheyes

New users

0xs8n Connor1105 VAENPP MachiavelliII pablosobrerobdo hocnc hipotermiahacks fishystock dulphMain dandh811 Serizao-bzhunt t0t048 LEEjieiun nullkrypt jonathanlevy-imper xkmikze L3ster1337 ixSly fiansodesmines x6vrn

Popular users

hackvertor (38)renniepak (9)JorianWoltjer (6)joaxcar (5)albinowax (5)0x999-x (4)RenwaX23 (4)masatokinugawa (3)d0ge (2)hansmach1ne (2)AyushXtha (2)securaji (1)DreyAnd (1)jonathann403 (1)B-i-t-K (1)koto (1)ThomasOrlita (1)weizman (1)InsertScript (1)K4r1it0 (1)

Recently updated vectors

Characters that starts element name Characters allowed between multiple HTML attributes Escape inline double quote Characters allowed javascript and colon < removal bypass Characters appended at the end of TLD within URL, which yield in the same Origin All properties on navigator (two levels of nesting deep)Characters allowed before the JavaScript protocol colon URL domain dot alternatives HTML tags that can clobber the credentials part of the URL Scheme slash alternatives in URL() when a base is used Characters allowed between hostname and / but don't change the hostname Entities that cause an external URL before @Characters between < and element name Characters that end unencapsulated HTML attribute values Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains Malformed HTML comments Characters that can precede the javascript protocol Characters allowed in the protocol that still resolve host name Characters that can be inside the javascript protocol

New vectors

Characters allowed in middle of HTML tag name Characters allowed as start of HTML tag name Valid space characters in a regex Unicode "Latin" characters using \p{scx=Latin} RegEx Characters matching RegEx /\w/ui Characters allowed in between // in absolute URL characters between function name and parentheses Characters allowed begin from a forward slash character in javascript protocol Characters allowed while closing script tag Characters after https URI scheme which prevent URL parsing of href chars before img tags Chars allowed before style attribute...Characters allowed before after onerror events Electron XSS TEST Characters allowed in between @import dsqd Closing title tag name separators masato - braves parsing finding entity test masato - braves parsing finding valid characters masato - braves parsing finding valid attributes

Most popular

URL domain dot alternatives (6.5k)Characters allowed javascript and colon (6.3k)JavaScript Scheme starting with https:// (6.2k)Characters allowed between hostname and / but don't change the hostname (5.3k)Characters between < and element name (5.3k)Characters that can precede the javascript protocol (5.1k)DOM element relationships (5k)HTML entities that create ASCII characters inside a JavaScript URL (4.7k)characters allowed between exclamation mark and greater then (4.6k)Characters allowed javascript and colon copy2 (4.5k)< removal bypass (4.2k)Characters appended at the end of TLD within URL, which yield in the same Origin (3.8k)Characters that close or encapsulate HTML attribute values (3.7k)Character that closes HTML tag (3.7k)Characters that cause exceptions when URL encoded (3.6k)Entities that cause an external URL before @ (3.6k)Unicode characters that get normalized into path traversal characters (3.5k)Characters allowed between multiple HTML attributes (3.4k)Characters allowed after hostname but don't change the hostname (3.4k)Includes Validation Chars Allowed (3.4k)

Most liked

URL domain dot alternatives (5)Entities that cause an external URL before @ (4)Characters allowed between multiple HTML attributes (4)Characters allowed between hostname and / but don't change the hostname (4)JavaScript Scheme starting with https:// (4)HTML entities that create ASCII characters inside a JavaScript URL (4)Characters allowed javascript and colon (3)Characters that can precede the javascript protocol (3)Characters allowed while closing script tag (3)Characters allowed inside javascript protocol and still returns the hostname (3)Characters that cause an external URL before @ (3)Characters allowed after optional chaining (2)HTML elements that are self closing or different text content (2)Characters allowed after hostname but don't change the hostname (2)Unicode characters that get normalized into path traversal characters (2)Characters that can be used as valid labels in JavaScript (2)Characters that cause exceptions when URL encoded (2)Characters that can start an HTML comment (2)Characters appended at the end of TLD within URL, which yield in the same Origin (2)Characters allowed in-between operators (2)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

lUcgryy

lUcgryy's profile

You are not following. Is not following you.

Followers: 0

Following: 0

Vectors 2

	Vector name	User	Created	Type	Likes
1 1 1	Characters that starts element name	lUcgryy	3/10/2025	HTML	0
1 1 1	Escape inline double quote	lUcgryy	3/7/2025	XSS	0