- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help
- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help

Smuggling...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

Includes Validation Chars Allowed
XSS vectors that consume tag
Escape inline double quote
Characters allowed between multiple HTML attributes
Characters to break out from eval string
Characters ending XML Processing Instructions (WIP)
Characters allowed javascript and colon
< removal bypass
Characters appended at the end of TLD within URL, which yield in the same Origin
Characters that can start an HTML comment
All properties on navigator (two levels of nesting deep)
Characters allowed after hostname but don't change the hostname
Characters allowed before the JavaScript protocol colon
Character allowed after onerror event
Find WAF bypass for eval context
Url parsing diff b/w anchor.href and new URL
URL domain dot alternatives
HTML tags that can clobber the credentials part of the URL
Scheme slash alternatives in URL() when a base is used
DOM element relationships

New collections

CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

JavaScript URLs allowed by the Sanitizer
Supported HTML and events by the Sanitizer
Supported HTML and attributes by the Sanitizer
String concat vs array join
CSS container queries
CSS :is() selector
indexOf vs includes
startsWith performance
startsWith vs regex
CSS :has() selector

Most Popular

URL domain dot alternatives(8k)
Characters allowed javascript and colon(7.4k)
JavaScript Scheme starting with https://(7k)
Characters allowed between hostname and / but don't change the hostname(6.1k)
Characters between < and element name(6k)
HTML entities that create ASCII characters inside a JavaScript URL(5.9k)
DOM element relationships(5.9k)
Characters that can precede the javascript protocol(5.8k)
characters allowed between exclamation mark and greater then (5.3k)
Characters allowed javascript and colon copy2(5.2k)

Most Liked

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Novice Fuzzer

RenwaX23

Fuzzing...

Error!

Renwa

@RenwaX23

1 Vector 0 Following 5 Followers

Posts Replies Likes Vectors

hackvertor

Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor.

renniepak

hexacedimalhaxer

sibivasanM

moza369