Characters allowed within a hostname but don't change the hostname

273

Checks what characters can be added in the middle of "https://example.com", while keeping the hostname "example.com"

Created by: ThomasOrlita

Created on: Tuesday, April 30, 2024 at 6:48:51 AM

Updated on: Monday, March 31, 2025 at 2:38:28 AM

Vector type: JS

Vector charset: UTF-8

Template used:
if (new URL("https://example.co" + String.fromCodePoint($[i]) + "m").hostname === 'example.com'){log($[i])}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}if (new URL("https://example.co" + String.fromCodePoint(6155) + "m").hostname === 'example.com'){alert(6155)}if (new URL("https://example.co" + String.fromCodePoint(6156) + "m").hostname === 'example.com'){alert(6156)}if (new URL("https://example.co" + String.fromCodePoint(6157) + "m").hostname === 'example.com'){alert(6157)}if (new URL("https://example.co" + String.fromCodePoint(6159) + "m").hostname === 'example.com'){alert(6159)}if (new URL("https://example.co" + String.fromCodePoint(8203) + "m").hostname === 'example.com'){alert(8203)}if (new URL("https://example.co" + String.fromCodePoint(8288) + "m").hostname === 'example.com'){alert(8288)}if (new URL("https://example.co" + String.fromCodePoint(8292) + "m").hostname === 'example.com'){alert(8292)}if (new URL("https://example.co" + String.fromCodePoint(65024) + "m").hostname === 'example.com'){alert(65024)}if (new URL("https://example.co" + String.fromCodePoint(65025) + "m").hostname === 'example.com'){alert(65025)}if (new URL("https://example.co" + String.fromCodePoint(65026) + "m").hostname === 'example.com'){alert(65026)}if (new URL("https://example.co" + String.fromCodePoint(65027) + "m").hostname === 'example.com'){alert(65027)}if (new URL("https://example.co" + String.fromCodePoint(65028) + "m").hostname === 'example.com'){alert(65028)}if (new URL("https://example.co" + String.fromCodePoint(65029) + "m").hostname === 'example.com'){alert(65029)}if (new URL("https://example.co" + String.fromCodePoint(65030) + "m").hostname === 'example.com'){alert(65030)}if (new URL("https://example.co" + String.fromCodePoint(65031) + "m").hostname === 'example.com'){alert(65031)}

Characters allowed within a hostname but don't change the hostname

Sample payloads

Fuzz results