Characters allowed as a class separator

This shows what characters can separate classes in HTML.

Created by: hackvertor

Created on: Saturday, April 13, 2024 at 7:33:01 PM

Updated on: Wednesday, May 14, 2025 at 8:20:05 AM

Detecting browser...

Category: HTML Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:

<div class="$[chr]x$[chr]"></div>

Code used after fuzz:

if(document.querySelector('.x'))log($[i]);

Sample payloads

<div class="0x09x0x09"></div>

<div class="
x
"></div>

<div class="0x0Cx0x0C"></div>

<div class="0x0Dx0x0D"></div>

<div class=" x "></div>