Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
<svg><image 0x09href="https://fuzz.shazzer.co.uk/3q8bfmx9unm?9" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image
href="https://fuzz.shazzer.co.uk/hy2i99i0q0m?10" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image 0x0Chref="https://fuzz.shazzer.co.uk/6n81xrwh0w?12" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image
href="https://fuzz.shazzer.co.uk/zkwcgm5llfn?13" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image href="https://fuzz.shazzer.co.uk/ihsrhbkh7pj?32" /></svg>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<img 0x09src=https://fuzz.shazzer.co.uk/r1dsm7bx4fg?9>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img
src=https://fuzz.shazzer.co.uk/ftggez3ppx4?10>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img 0x0Csrc=https://fuzz.shazzer.co.uk/0ejilgxxkue?12>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img
src=https://fuzz.shazzer.co.uk/sv4w319ndhs?13>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img src=https://fuzz.shazzer.co.uk/kom9whuojgg?32>Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<x0x00 id=x><x0x09 id=x><x
id=x><x0x0C id=x><x
id=x><x0x00 id=x><x0x09 id=x><x
id=x><x0x0C id=x><x
id=x>if (new URL("https://example.com/"+String.fromCodePoint(9)+"test").pathname==="/test") alert(9);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(10)+"test").pathname==="/test") alert(10);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/"+String.fromCodePoint(13)+"test").pathname==="/test") alert(13);Checks which characters are ignored before URL path components in JavaScript.
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(0)+"").searchParams.get("param1") === "value") alert(0)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(1)+"").searchParams.get("param1") === "value") alert(1)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(2)+"").searchParams.get("param1") === "value") alert(2)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(3)+"").searchParams.get("param1") === "value") alert(3)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?param1=value"+String.fromCodePoint(4)+"").searchParams.get("param1") === "value") alert(4)Tests which characters are ignored in a query parameter value using URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(9)+"param1=value").searchParams.get("param1") === "value") alert(9)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(10)+"param1=value").searchParams.get("param1") === "value") alert(10)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(13)+"param1=value").searchParams.get("param1") === "value") alert(13)Tests which characters are ignored in a query parameter name using the URL constructor
if (new URL("https://example.com/query?"+String.fromCodePoint(38)+"param1=value").searchParams.get("param1") === "value") alert(38)Tests which characters are ignored in a query parameter name using the URL constructor
new URL("https://example1.com"+String.fromCodePoint(35)+"@example2.com").host === "example1.com" && alert(35)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(47)+"@example2.com").host === "example1.com" && alert(47)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(63)+"@example2.com").host === "example1.com" && alert(63)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
new URL("https://example1.com"+String.fromCodePoint(92)+"@example2.com").host === "example1.com" && alert(92)Tests which characters are accepted within URL hostnames that return the first part of the URL when separated by @.
<div style="background:url('/\0x09/fuzz.shazzer.co.uk/r4tzynjb7hh?9')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\
/fuzz.shazzer.co.uk/hug1eceaz1e?10')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\0x0C/fuzz.shazzer.co.uk/zxjbxaefmuk?12')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\
/fuzz.shazzer.co.uk/6npdipc2tns?13')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
<div style="background:url('/\//fuzz.shazzer.co.uk/6x4pc5vfdex?47')">Tests which characters escaped cause an external request in-between forward slashes within a CSS URL scheme for background images.
new URL("https://"+String.fromCodePoint(69)+"xample.com").host === "example.com" && alert(69)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(101)+"xample.com").host === "example.com" && alert(101)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7473)+"xample.com").host === "example.com" && alert(7473)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(7497)+"xample.com").host === "example.com" && alert(7497)Tests which characters represent the character "e" in a URL constructor host
new URL("https://"+String.fromCodePoint(8337)+"xample.com").host === "example.com" && alert(8337)Tests which characters represent the character "e" in a URL constructor host
<a href="https://example.com?foo" id=x></a>This uses the query property to detect if the character is a question mark
<a href="https://example.com#foo" id=x></a><a href="https://example.com/foo" id=x></a><a href="https://example.com\foo" id=x></a>if (new URL("https://example.com" + String.fromCodePoint(35) + "foo").hash.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(63) + "foo").search.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(47) + "foo").pathname.includes("foo")) alert(i)if (new URL("https://example.com" + String.fromCodePoint(92) + "foo").pathname.includes("foo")) alert(i)if (new URL("https:"+String.fromCodePoint(9)+"example.com").hostname=="example.com") alert(9)Tests which characters are ignored or act as a forward slash after protocol within a URL constructor.
if (new URL("https:"+String.fromCodePoint(10)+"example.com").hostname=="example.com") alert(10)Tests which characters are ignored or act as a forward slash after protocol within a URL constructor.
if (new URL("https:"+String.fromCodePoint(13)+"example.com").hostname=="example.com") alert(13)Tests which characters are ignored or act as a forward slash after protocol within a URL constructor.
if (new URL("https:"+String.fromCodePoint(47)+"example.com").hostname=="example.com") alert(47)Tests which characters are ignored or act as a forward slash after protocol within a URL constructor.
if (new URL("https:"+String.fromCodePoint(64)+"example.com").hostname=="example.com") alert(64)Tests which characters are ignored or act as a forward slash after protocol within a URL constructor.
if (new URL("https://example.com"+String.fromCodePoint(0)).hostname=="example.com") alert(0)if (new URL("https://example.com"+String.fromCodePoint(1)).hostname=="example.com") alert(1)if (new URL("https://example.com"+String.fromCodePoint(2)).hostname=="example.com") alert(2)if (new URL("https://example.com"+String.fromCodePoint(3)).hostname=="example.com") alert(3)if (new URL("https://example.com"+String.fromCodePoint(4)).hostname=="example.com") alert(4)if (new URL("https://example.com"+String.fromCodePoint(9)+":8000").hostname=="example.com") alert(9)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(10)+":8000").hostname=="example.com") alert(10)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(13)+":8000").hostname=="example.com") alert(13)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(35)+":8000").hostname=="example.com") alert(35)Tests which characters are ignored in hostname within a URL constructor before colon.
if (new URL("https://example.com"+String.fromCodePoint(47)+":8000").hostname=="example.com") alert(47)Tests which characters are ignored in hostname within a URL constructor before colon.
const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint(9)+'@import url(https://fuzz.shazzer.co.uk/t1m0k13914p?9);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix with curlies.
const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint(10)+'@import url(https://fuzz.shazzer.co.uk/6ddiyu1wfv3?10);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix with curlies.
const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint(12)+'@import url(https://fuzz.shazzer.co.uk/tznde9wep1e?12);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix with curlies.
const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint(13)+'@import url(https://fuzz.shazzer.co.uk/kjut5fym1hh?13);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix with curlies.
const style = document.createElement("style");
style.textContent = '@x{}'+String.fromCodePoint(32)+'@import url(https://fuzz.shazzer.co.uk/3ykwoony85?32);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix with curlies.