Shazzer - Shared online fuzzing

Dangling...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

Invalid selector characters with a prefix of x
Characters allowed before image-set function
Characters allowed as CSS variable names
SVG elements & attributes that make external requests
CSS Properties that make external requests
CSS Properties and functions that make external requests
CSS escapes that cause an external request with a forward slash
CSS hex escapes that cause an external request in-between forward slashes
Escaped characters that cause an external request in-between forward slashes
CSS class name separators
Characters before CSS property names
Characters before a CSS background url function
Entities allowed after slashes on a protocol relative URL
Entities still parsed in uppercase
Mutated XSS Attributes
Difference between browser-supported handlers and Shazzer 'events' list
Characters that can work as attribute seperator
Entities allowed between two forward slashes
Entities in-between square brackets that close cdata
Characters in-between square brackets that close cdata

New collections

CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

character between url and ( for import
JavaScript URLs allowed by the Sanitizer
Supported HTML and events by the Sanitizer
Supported HTML and attributes by the Sanitizer
String concat vs array join
CSS container queries
CSS :is() selector
indexOf vs includes
startsWith performance
startsWith vs regex

Most Popular

URL domain dot alternatives(8.1k)
Characters allowed javascript and colon(7.4k)
JavaScript Scheme starting with https://(7.1k)
Characters allowed between hostname and / but don't change the hostname(6.2k)
Characters between < and element name(6k)
HTML entities that create ASCII characters inside a JavaScript URL(6k)
DOM element relationships(5.9k)
Characters that can precede the javascript protocol(5.9k)
characters allowed between exclamation mark and greater then (5.3k)
Characters allowed javascript and colon copy2(5.2k)

Most Liked

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Shazzer - Shared online fuzzing