Characters allowed between hostname and / but don't change the hostname

Chrome logo 278
Firefox logo 278
Safari logo 278

Checks what characters can be added between "https://example.com" and /, while keeping the hostname "example.com"

Created by: ThomasOrlita

Created on: Monday, April 15, 2024 at 11:30:20 PM

Updated on: Tuesday, December 10, 2024 at 9:05:17 PM

Vector type: JS

Vector charset: UTF-8

Template used:
if (new URL("https://example.com" + String.fromCodePoint($[i]) + "/").hostname === 'example.com'){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("https://example.com" + String.fromCodePoint(9) + "/").hostname === 'example.com'){alert(9)}
if (new URL("https://example.com" + String.fromCodePoint(10) + "/").hostname === 'example.com'){alert(10)}
if (new URL("https://example.com" + String.fromCodePoint(13) + "/").hostname === 'example.com'){alert(13)}
if (new URL("https://example.com" + String.fromCodePoint(35) + "/").hostname === 'example.com'){alert(35)}
if (new URL("https://example.com" + String.fromCodePoint(47) + "/").hostname === 'example.com'){alert(47)}
if (new URL("https://example.com" + String.fromCodePoint(58) + "/").hostname === 'example.com'){alert(58)}
if (new URL("https://example.com" + String.fromCodePoint(63) + "/").hostname === 'example.com'){alert(63)}
if (new URL("https://example.com" + String.fromCodePoint(92) + "/").hostname === 'example.com'){alert(92)}
if (new URL("https://example.com" + String.fromCodePoint(173) + "/").hostname === 'example.com'){alert(173)}
if (new URL("https://example.com" + String.fromCodePoint(847) + "/").hostname === 'example.com'){alert(847)}
if (new URL("https://example.com" + String.fromCodePoint(6155) + "/").hostname === 'example.com'){alert(6155)}
if (new URL("https://example.com" + String.fromCodePoint(6156) + "/").hostname === 'example.com'){alert(6156)}
if (new URL("https://example.com" + String.fromCodePoint(6157) + "/").hostname === 'example.com'){alert(6157)}
if (new URL("https://example.com" + String.fromCodePoint(6159) + "/").hostname === 'example.com'){alert(6159)}
if (new URL("https://example.com" + String.fromCodePoint(8203) + "/").hostname === 'example.com'){alert(8203)}
if (new URL("https://example.com" + String.fromCodePoint(8288) + "/").hostname === 'example.com'){alert(8288)}
if (new URL("https://example.com" + String.fromCodePoint(8292) + "/").hostname === 'example.com'){alert(8292)}
if (new URL("https://example.com" + String.fromCodePoint(65024) + "/").hostname === 'example.com'){alert(65024)}
if (new URL("https://example.com" + String.fromCodePoint(65025) + "/").hostname === 'example.com'){alert(65025)}
if (new URL("https://example.com" + String.fromCodePoint(65026) + "/").hostname === 'example.com'){alert(65026)}

Fuzz results

Chrome logo
Chrome 124.0.0.0 Unknown Unknown

Updated

Wed May 01 2024
Found 278 results
Loading...
Firefox logo
Firefox 125.0 Unknown Unknown

Updated

Wed May 01 2024
Found 278 results
Loading...
Safari logo
Safari 17.4 Unknown Unknown

Updated

Wed May 01 2024
Found 278 results
Loading...
Chrome logo
Chrome 127.0.0.0 desktop macOS 10.15.7

Updated

Tue Aug 20 2024
Found 34 results
Loading...
Firefox logo
Firefox 129.0 desktop macOS 10.15

Updated

Tue Aug 20 2024
Found 34 results
Loading...
Safari logo
Safari 17.6 mobile iOS 17.6.1

Updated

Tue Aug 20 2024
Found 34 results
Loading...