Characters allowed within a hostname but don't change the hostname
273
29
29
Checks what characters can be added in the middle of "https://example.com", while keeping the hostname "example.com"
Created by: ThomasOrlita
Created on: Tuesday, April 30, 2024 at 6:48:51 AM
Updated on: Wednesday, November 20, 2024 at 8:38:25 PM
Vector type: JS
Vector charset: UTF-8
Template used:
if (new URL("https://example.co" + String.fromCodePoint($[i]) + "m").hostname === 'example.com'){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}
if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}
if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}
if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}
if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}
if (new URL("https://example.co" + String.fromCodePoint(6155) + "m").hostname === 'example.com'){alert(6155)}
if (new URL("https://example.co" + String.fromCodePoint(6156) + "m").hostname === 'example.com'){alert(6156)}
if (new URL("https://example.co" + String.fromCodePoint(6157) + "m").hostname === 'example.com'){alert(6157)}
if (new URL("https://example.co" + String.fromCodePoint(6159) + "m").hostname === 'example.com'){alert(6159)}
if (new URL("https://example.co" + String.fromCodePoint(8203) + "m").hostname === 'example.com'){alert(8203)}
if (new URL("https://example.co" + String.fromCodePoint(8288) + "m").hostname === 'example.com'){alert(8288)}
if (new URL("https://example.co" + String.fromCodePoint(8292) + "m").hostname === 'example.com'){alert(8292)}
if (new URL("https://example.co" + String.fromCodePoint(65024) + "m").hostname === 'example.com'){alert(65024)}
if (new URL("https://example.co" + String.fromCodePoint(65025) + "m").hostname === 'example.com'){alert(65025)}
if (new URL("https://example.co" + String.fromCodePoint(65026) + "m").hostname === 'example.com'){alert(65026)}
if (new URL("https://example.co" + String.fromCodePoint(65027) + "m").hostname === 'example.com'){alert(65027)}
if (new URL("https://example.co" + String.fromCodePoint(65028) + "m").hostname === 'example.com'){alert(65028)}
if (new URL("https://example.co" + String.fromCodePoint(65029) + "m").hostname === 'example.com'){alert(65029)}
if (new URL("https://example.co" + String.fromCodePoint(65030) + "m").hostname === 'example.com'){alert(65030)}
if (new URL("https://example.co" + String.fromCodePoint(65031) + "m").hostname === 'example.com'){alert(65031)}
Fuzz results
Chrome 124.0.0.0 Unknown Unknown
Updated
Wed May 01 2024
Found 273 results
Loading...
Chrome 127.0.0.0 desktop macOS 10.15.7
Updated
Tue Aug 20 2024
Found 29 results
Loading...
Firefox 129.0 desktop macOS 10.15
Updated
Tue Aug 20 2024
Found 29 results
Loading...
Safari 17.6 mobile iOS 17.6.1
Updated
Tue Aug 20 2024
Found 29 results
Loading...