Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 210 vectors with results
b1 = Math.floor(i / 256);0x0D
b2 = i % 256;0x0D
c = d.decode(new Uint8Array([0x1b, 0x24, 0x40, b1, b2])) 0x0D
if (c.split("").map((c) => c.charCodeAt(0)).some((i) => i < 127)) alert(i)Sequences of two bytes that when in the ISO-2022-JP charset and preceded by the JIS X 0201 1978 escape sequence, produce any ASCII character after decoding.
<style>0x0D
0x01{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>0x0D
0x02{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>0x0D
0x03{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>0x0D
0x04{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>0x0D
0x05{position:"⟦0D⟧
}@import'data:text/css,%23x{color:red}';⟦0D⟧
</style>0x0D
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<div id="x9"><span x="href=0x09>&bbb"></span></div>0x0D
<script>0x0D
window["x9"].innerHTML=window["x9"].innerHTML;0x0D
if (window["x9"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(9)0x0D
}0x0D
</script><div id="x10"><span x="href=
>&bbb"></span></div>0x0D
<script>0x0D
window["x10"].innerHTML=window["x10"].innerHTML;0x0D
if (window["x10"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(10)0x0D
}0x0D
</script><div id="x12"><span x="href=0x0C>&bbb"></span></div>0x0D
<script>0x0D
window["x12"].innerHTML=window["x12"].innerHTML;0x0D
if (window["x12"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(12)0x0D
}0x0D
</script><div id="x13"><span x="href=0x0D>&bbb"></span></div>0x0D
<script>0x0D
window["x13"].innerHTML=window["x13"].innerHTML;0x0D
if (window["x13"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(13)0x0D
}0x0D
</script><div id="x32"><span x="href= >&bbb"></span></div>0x0D
<script>0x0D
window["x32"].innerHTML=window["x32"].innerHTML;0x0D
if (window["x32"].firstChild.getAttribute("href") != null)0x0D
{0x0D
alert(32)0x0D
}0x0D
</script>if (new URL("https://google.com:10x000x00/endpoint").hostname!="google.com"){alert(0)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:10x090x09/endpoint").hostname!="google.com"){alert(9)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1##/endpoint").hostname!="google.com"){alert(35)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1///endpoint").hostname!="google.com"){alert(47)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:100/endpoint").hostname!="google.com"){alert(48)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
s = "0";0x0D
if (typeof s["0x00__proto__"] != "undefined") {0x0D
alert(fromCodePoint(0));0x0D
}Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.
let chr = String.fromCodePoint(33);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(33)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(43);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(43)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(47);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(47)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(64);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(64)This vector shows the differences between escape and encodeURIComponent
<a href="https://0x09example.com/" id="test9"></a><a href="https://
example.com/" id="test10"></a><a href="https://0x0Dexample.com/" id="test13"></a><a href="https:///example.com/" id="test47"></a><a href="https://@example.com/" id="test64"></a>if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
<style>@import url⟦00⟧('https://juicesippy.net/style.css');</style>checkSanitizer('<a href="�javascript:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="java�script:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="javascript�:foo">test</a>') && alert[i];Checks if JS urls are supported by the HTML Sanitizer API.
const url = new URL(`/${String.fromCodePoint(0)}javascript:alert(origin)`);0x0D
if (url.protocol === 'javascript:') {0x0D
alert(0);0x0D
}Fuzz if window.location.href = `/${user_input}`; can redirect to javascript pseudo protocol.
<style>⟦0D⟧
@import⟦00⟧'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D
<0x00xss autofocus tabindex=1 onfocus=alert(0)></xss>Vector to test what characters are allowed in a custom HTML tag
<a href="https://0x00.example.com/" id="test0"></a>Checks which characters are allowed before a domain name.
<img src="/image.png" tag="0x00><iframe><!--">Checks for any escaping from the img tag attribute from encoded input without using double quotes
Page 1 of 11