Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 211 vectors with results
<div id=x style="0x09color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="
color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="0x0Ccolor:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="
color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style=" color:red">test</div>
This vector shows which characters are allowed before a CSS property name
for(const prop in document){
alert(prop);
}<style>
0x01{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x02{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x03{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x04{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x05{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
b1 = Math.floor(i / 256);
b2 = i % 256;
c = d.decode(new Uint8Array([0x1b, 0x24, 0x40, b1, b2]))
if (c.split("").map((c) => c.charCodeAt(0)).some((i) => i < 127)) alert(i)Sequences of two bytes that when in the ISO-2022-JP charset and preceded by the JIS X 0201 1978 escape sequence, produce any ASCII character after decoding.
fetch(String.fromCodePoint(0)+"//fuzz.shazzer.co.uk/fzf2gvcpsqj?0")Tests which characters are valid before a protocol relative URL in fetch().
fetch(String.fromCodePoint(1)+"//fuzz.shazzer.co.uk/s2j51s5fwy?1")Tests which characters are valid before a protocol relative URL in fetch().
fetch(String.fromCodePoint(2)+"//fuzz.shazzer.co.uk/0h92k4z42mxf?2")Tests which characters are valid before a protocol relative URL in fetch().
fetch(String.fromCodePoint(3)+"//fuzz.shazzer.co.uk/hr3aiv6948a?3")Tests which characters are valid before a protocol relative URL in fetch().
fetch(String.fromCodePoint(4)+"//fuzz.shazzer.co.uk/ky831y1kzdf?4")Tests which characters are valid before a protocol relative URL in fetch().
Object.getOwnPropertyNames(window).forEach(prop=>alert(prop))<div id="x9"><span x="href=0x09>&bbb"></span></div>
<script>
window["x9"].innerHTML=window["x9"].innerHTML;
if (window["x9"].firstChild.getAttribute("href") != null)
{
alert(9)
}
</script><div id="x10"><span x="href=
>&bbb"></span></div>
<script>
window["x10"].innerHTML=window["x10"].innerHTML;
if (window["x10"].firstChild.getAttribute("href") != null)
{
alert(10)
}
</script><div id="x12"><span x="href=0x0C>&bbb"></span></div>
<script>
window["x12"].innerHTML=window["x12"].innerHTML;
if (window["x12"].firstChild.getAttribute("href") != null)
{
alert(12)
}
</script><div id="x13"><span x="href=
>&bbb"></span></div>
<script>
window["x13"].innerHTML=window["x13"].innerHTML;
if (window["x13"].firstChild.getAttribute("href") != null)
{
alert(13)
}
</script><div id="x32"><span x="href= >&bbb"></span></div>
<script>
window["x32"].innerHTML=window["x32"].innerHTML;
if (window["x32"].firstChild.getAttribute("href") != null)
{
alert(32)
}
</script>if (new URL("https://google.com:10x090x09/endpoint").hostname!="google.com"){alert(9)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1##/endpoint").hostname!="google.com"){alert(35)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1///endpoint").hostname!="google.com"){alert(47)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:100/endpoint").hostname!="google.com"){alert(48)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:111/endpoint").hostname!="google.com"){alert(49)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a GBK charset
<div id=x style="co\lor:red">test</div>
This vector shows which characters are allowed in-between a CSS property name
This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.
<0x1B(<img src onerror=alert(60)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
<0x1B(Bimg src onerror=alert(66)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
<0x1B(Jimg src onerror=alert(74)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
const chars = "abcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
let encodings = new Map();
for (let i = 0; i < chars.length; i++) {
let c = chars[i];
for (let i = 127; i < 65536; i++) {
let str = String.fromCodePoint(i);
try {
let payload = `http://${str}example.com`;
let u = new URL(payload);
if (u.hostname === `${c}example.com`) {
alert(i)
}
} catch {}
}
}<style>
0x09div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
0x0Cdiv{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<div id=x style="--�:red;color:var(--�)">test</div><div id=x style="---:red;color:var(---)">test</div><div id=x style="--_:red;color:var(--_)">test</div>if (new URL("https://example" + String.fromCodePoint(i) + "com").host == "example.com") alert(i)s = "0";
if (typeof s["0x00__proto__"] != "undefined") {
alert(String.fromCodePoint(0));
}Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.
Object.getOwnPropertyNames(window).forEach(prop=>/^on/.test(prop)&&alert(prop))Page 1 of 11