Characters allowed within a hostname but don't change the hostname

⚠ Browser differences

Checks what characters can be added in the middle of "https://example.com", while keeping the hostname "example.com"

Created by: ThomasOrlita

Created on: Tuesday, April 30, 2024 at 6:48:51 AM

Updated on: Wednesday, May 14, 2025 at 3:05:56 PM

Detecting browser...

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:

if (new URL("https://example.co" + String.fromCodePoint($[i]) + "m").hostname === 'example.com'){log($[i])}

Sample payloads

if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}

if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}

if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}

if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}

if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}

if (new URL("https://example.co" + String.fromCodePoint(4447) + "m").hostname === 'example.com'){alert(4447)}

if (new URL("https://example.co" + String.fromCodePoint(4448) + "m").hostname === 'example.com'){alert(4448)}

if (new URL("https://example.co" + String.fromCodePoint(6068) + "m").hostname === 'example.com'){alert(6068)}

if (new URL("https://example.co" + String.fromCodePoint(6069) + "m").hostname === 'example.com'){alert(6069)}

if (new URL("https://example.co" + String.fromCodePoint(6155) + "m").hostname === 'example.com'){alert(6155)}

if (new URL("https://example.co" + String.fromCodePoint(6156) + "m").hostname === 'example.com'){alert(6156)}

if (new URL("https://example.co" + String.fromCodePoint(6157) + "m").hostname === 'example.com'){alert(6157)}

if (new URL("https://example.co" + String.fromCodePoint(6158) + "m").hostname === 'example.com'){alert(6158)}

if (new URL("https://example.co" + String.fromCodePoint(6159) + "m").hostname === 'example.com'){alert(6159)}

if (new URL("https://example.co" + String.fromCodePoint(8203) + "m").hostname === 'example.com'){alert(8203)}

if (new URL("https://example.co" + String.fromCodePoint(8288) + "m").hostname === 'example.com'){alert(8288)}

if (new URL("https://example.co" + String.fromCodePoint(8289) + "m").hostname === 'example.com'){alert(8289)}

if (new URL("https://example.co" + String.fromCodePoint(8290) + "m").hostname === 'example.com'){alert(8290)}

if (new URL("https://example.co" + String.fromCodePoint(8291) + "m").hostname === 'example.com'){alert(8291)}

if (new URL("https://example.co" + String.fromCodePoint(8292) + "m").hostname === 'example.com'){alert(8292)}