- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help
- Home
- Vectors
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- Help

Fuzzing...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

JIS X 0208 bytes that produce ASCII characters
Characters allowed at hostname
Chars in href that will not default to full URL
document properties
All events on window
Window properties
All properties on navigator (two levels of nesting deep)
Characters allowed before CSS selectors
Characters allowed after !
Invalid selector characters
HTML elements that inherit properties which return the full URL
HTML entities spaces
domain values
Characters that can break out of an inline style background-image url
Url parsing diff b/w anchor.href and new URL
masato - braves parsing finding entity test
Bypass __proto__ string match defense
Characters appended at the end of PORT within URL, which yield a different HOST
masato - braves parsing finding
masato - braves parsing finding valid attributes

New collections

CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

URL fuzzing attributes
character between url and ( for import
JavaScript URLs allowed by the Sanitizer
Supported HTML and events by the Sanitizer
Supported HTML and attributes by the Sanitizer
String concat vs array join
CSS container queries
CSS :is() selector
indexOf vs includes
startsWith performance

Most Popular

URL domain dot alternatives(8.1k)
Characters allowed javascript and colon(7.5k)
JavaScript Scheme starting with https://(7.1k)
Characters allowed between hostname and / but don't change the hostname(6.2k)
Characters between < and element name(6k)
HTML entities that create ASCII characters inside a JavaScript URL(6k)
DOM element relationships(5.9k)
Characters that can precede the javascript protocol(5.9k)
characters allowed between exclamation mark and greater then (5.3k)
Characters allowed javascript and colon copy2(5.2k)

Most Liked

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Unicode table

Loading...

0-127