Characters allowed between an object and the dot operator

List of characters allowed between an object and the dot operator located before the method/property.

Created by: cold-try

Created on: Monday, April 15, 2024 at 6:15:33 PM

Updated on: Thursday, May 15, 2025 at 4:37:01 PM

Category: XSS Execution

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:
window$[chr].alert();log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

window .alert();alert(9)

window
.alert();alert(10)

window.alert();alert(11)window.alert();alert(12)

window
.alert();alert(13)

window .alert();alert(32)window?.alert();alert(63)window .alert();alert(160)window .alert();alert(5760)window .alert();alert(8192)window .alert();alert(8193)window .alert();alert(8194)window .alert();alert(8195)window .alert();alert(8196)window .alert();alert(8197)window .alert();alert(8198)window .alert();alert(8199)window .alert();alert(8200)window .alert();alert(8201)window .alert();alert(8202)