Characters not urlencoded when using the credentials part of the URL

This vector shows which characters are not encoded in the credentials part of the URL.

Created by: hackvertor

Created on: 5/28/2024, 10:11:36 PM

Updated on: 6/27/2024, 6:53:07 AM

Vector type: JS

Code used before fuzz:
const anchor = document.createElement('a');
Template used:
anchor.href='//example.com';
anchor.username = String.fromCodePoint($[i]);
if(!/%/.test(anchor+''))log($[i])
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

anchor.href='//example.com';
anchor.username = String.fromCodePoint(33);
if(!/%/.test(anchor+''))alert(33)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(36);
if(!/%/.test(anchor+''))alert(36)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(38);
if(!/%/.test(anchor+''))alert(38)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(40);
if(!/%/.test(anchor+''))alert(40)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(41);
if(!/%/.test(anchor+''))alert(41)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(42);
if(!/%/.test(anchor+''))alert(42)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(43);
if(!/%/.test(anchor+''))alert(43)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(44);
if(!/%/.test(anchor+''))alert(44)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(45);
if(!/%/.test(anchor+''))alert(45)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(46);
if(!/%/.test(anchor+''))alert(46)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(48);
if(!/%/.test(anchor+''))alert(48)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(49);
if(!/%/.test(anchor+''))alert(49)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(50);
if(!/%/.test(anchor+''))alert(50)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(51);
if(!/%/.test(anchor+''))alert(51)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(52);
if(!/%/.test(anchor+''))alert(52)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(53);
if(!/%/.test(anchor+''))alert(53)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(54);
if(!/%/.test(anchor+''))alert(54)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(55);
if(!/%/.test(anchor+''))alert(55)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(56);
if(!/%/.test(anchor+''))alert(56)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(57);
if(!/%/.test(anchor+''))alert(57)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(65);
if(!/%/.test(anchor+''))alert(65)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(66);
if(!/%/.test(anchor+''))alert(66)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(67);
if(!/%/.test(anchor+''))alert(67)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(68);
if(!/%/.test(anchor+''))alert(68)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(69);
if(!/%/.test(anchor+''))alert(69)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(70);
if(!/%/.test(anchor+''))alert(70)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(71);
if(!/%/.test(anchor+''))alert(71)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(72);
if(!/%/.test(anchor+''))alert(72)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(73);
if(!/%/.test(anchor+''))alert(73)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(74);
if(!/%/.test(anchor+''))alert(74)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(75);
if(!/%/.test(anchor+''))alert(75)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(76);
if(!/%/.test(anchor+''))alert(76)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(77);
if(!/%/.test(anchor+''))alert(77)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(78);
if(!/%/.test(anchor+''))alert(78)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(79);
if(!/%/.test(anchor+''))alert(79)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(80);
if(!/%/.test(anchor+''))alert(80)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(81);
if(!/%/.test(anchor+''))alert(81)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(82);
if(!/%/.test(anchor+''))alert(82)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(83);
if(!/%/.test(anchor+''))alert(83)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(84);
if(!/%/.test(anchor+''))alert(84)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(85);
if(!/%/.test(anchor+''))alert(85)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(86);
if(!/%/.test(anchor+''))alert(86)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(87);
if(!/%/.test(anchor+''))alert(87)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(88);
if(!/%/.test(anchor+''))alert(88)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(89);
if(!/%/.test(anchor+''))alert(89)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(90);
if(!/%/.test(anchor+''))alert(90)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(95);
if(!/%/.test(anchor+''))alert(95)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(97);
if(!/%/.test(anchor+''))alert(97)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(98);
if(!/%/.test(anchor+''))alert(98)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(99);
if(!/%/.test(anchor+''))alert(99)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(100);
if(!/%/.test(anchor+''))alert(100)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(101);
if(!/%/.test(anchor+''))alert(101)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(102);
if(!/%/.test(anchor+''))alert(102)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(103);
if(!/%/.test(anchor+''))alert(103)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(104);
if(!/%/.test(anchor+''))alert(104)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(105);
if(!/%/.test(anchor+''))alert(105)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(106);
if(!/%/.test(anchor+''))alert(106)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(107);
if(!/%/.test(anchor+''))alert(107)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(108);
if(!/%/.test(anchor+''))alert(108)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(109);
if(!/%/.test(anchor+''))alert(109)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(110);
if(!/%/.test(anchor+''))alert(110)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(111);
if(!/%/.test(anchor+''))alert(111)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(112);
if(!/%/.test(anchor+''))alert(112)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(113);
if(!/%/.test(anchor+''))alert(113)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(114);
if(!/%/.test(anchor+''))alert(114)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(115);
if(!/%/.test(anchor+''))alert(115)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(116);
if(!/%/.test(anchor+''))alert(116)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(117);
if(!/%/.test(anchor+''))alert(117)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(118);
if(!/%/.test(anchor+''))alert(118)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(119);
if(!/%/.test(anchor+''))alert(119)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(120);
if(!/%/.test(anchor+''))alert(120)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(121);
if(!/%/.test(anchor+''))alert(121)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(122);
if(!/%/.test(anchor+''))alert(122)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(126);
if(!/%/.test(anchor+''))alert(126)
anchor.href='//example.com';
anchor.username = String.fromCodePoint(39);
if(!/%/.test(anchor+''))alert(39)

Fuzz results

Chrome logo
Chrome 125.0.0.0 Unknown Unknown
Found 74 results
DecHexChr
3321!
DecHexChr
3624$
DecHexChr
3826&
DecHexChr
4028(
DecHexChr
4129)
DecHexChr
422a*
DecHexChr
432b+
DecHexChr
442c,
DecHexChr
452d-
DecHexChr
462e.
DecHexChr
48300
DecHexChr
49311
DecHexChr
50322
DecHexChr
51333
DecHexChr
52344
DecHexChr
53355
DecHexChr
54366
DecHexChr
55377
DecHexChr
56388
DecHexChr
57399
DecHexChr
6541A
DecHexChr
6642B
DecHexChr
6743C
DecHexChr
6844D
DecHexChr
6945E
DecHexChr
7046F
DecHexChr
7147G
DecHexChr
7248H
DecHexChr
7349I
DecHexChr
744aJ
DecHexChr
754bK
DecHexChr
764cL
DecHexChr
774dM
DecHexChr
784eN
DecHexChr
794fO
DecHexChr
8050P
DecHexChr
8151Q
DecHexChr
8252R
DecHexChr
8353S
DecHexChr
8454T
DecHexChr
8555U
DecHexChr
8656V
DecHexChr
8757W
DecHexChr
8858X
DecHexChr
8959Y
DecHexChr
905aZ
DecHexChr
955f_
DecHexChr
9761a
DecHexChr
9862b
DecHexChr
9963c
DecHexChr
10064d
DecHexChr
10165e
DecHexChr
10266f
DecHexChr
10367g
DecHexChr
10468h
DecHexChr
10569i
DecHexChr
1066aj
DecHexChr
1076bk
DecHexChr
1086cl
DecHexChr
1096dm
DecHexChr
1106en
DecHexChr
1116fo
DecHexChr
11270p
DecHexChr
11371q
DecHexChr
11472r
DecHexChr
11573s
DecHexChr
11674t
DecHexChr
11775u
DecHexChr
11876v
DecHexChr
11977w
DecHexChr
12078x
DecHexChr
12179y
DecHexChr
1227az
DecHexChr
1267e~
Firefox logo
Firefox 126.0 Unknown Unknown
Found 75 results
DecHexChr
3321!
DecHexChr
3624$
DecHexChr
3826&
DecHexChr
3927'
DecHexChr
4028(
DecHexChr
4129)
DecHexChr
422a*
DecHexChr
432b+
DecHexChr
442c,
DecHexChr
452d-
DecHexChr
462e.
DecHexChr
48300
DecHexChr
49311
DecHexChr
50322
DecHexChr
51333
DecHexChr
52344
DecHexChr
53355
DecHexChr
54366
DecHexChr
55377
DecHexChr
56388
DecHexChr
57399
DecHexChr
6541A
DecHexChr
6642B
DecHexChr
6743C
DecHexChr
6844D
DecHexChr
6945E
DecHexChr
7046F
DecHexChr
7147G
DecHexChr
7248H
DecHexChr
7349I
DecHexChr
744aJ
DecHexChr
754bK
DecHexChr
764cL
DecHexChr
774dM
DecHexChr
784eN
DecHexChr
794fO
DecHexChr
8050P
DecHexChr
8151Q
DecHexChr
8252R
DecHexChr
8353S
DecHexChr
8454T
DecHexChr
8555U
DecHexChr
8656V
DecHexChr
8757W
DecHexChr
8858X
DecHexChr
8959Y
DecHexChr
905aZ
DecHexChr
955f_
DecHexChr
9761a
DecHexChr
9862b
DecHexChr
9963c
DecHexChr
10064d
DecHexChr
10165e
DecHexChr
10266f
DecHexChr
10367g
DecHexChr
10468h
DecHexChr
10569i
DecHexChr
1066aj
DecHexChr
1076bk
DecHexChr
1086cl
DecHexChr
1096dm
DecHexChr
1106en
DecHexChr
1116fo
DecHexChr
11270p
DecHexChr
11371q
DecHexChr
11472r
DecHexChr
11573s
DecHexChr
11674t
DecHexChr
11775u
DecHexChr
11876v
DecHexChr
11977w
DecHexChr
12078x
DecHexChr
12179y
DecHexChr
1227az
DecHexChr
1267e~
Safari logo
Safari 17.4 Unknown Unknown
Found 75 results
DecHexChr
3321!
DecHexChr
3624$
DecHexChr
3826&
DecHexChr
3927'
DecHexChr
4028(
DecHexChr
4129)
DecHexChr
422a*
DecHexChr
432b+
DecHexChr
442c,
DecHexChr
452d-
DecHexChr
462e.
DecHexChr
48300
DecHexChr
49311
DecHexChr
50322
DecHexChr
51333
DecHexChr
52344
DecHexChr
53355
DecHexChr
54366
DecHexChr
55377
DecHexChr
56388
DecHexChr
57399
DecHexChr
6541A
DecHexChr
6642B
DecHexChr
6743C
DecHexChr
6844D
DecHexChr
6945E
DecHexChr
7046F
DecHexChr
7147G
DecHexChr
7248H
DecHexChr
7349I
DecHexChr
744aJ
DecHexChr
754bK
DecHexChr
764cL
DecHexChr
774dM
DecHexChr
784eN
DecHexChr
794fO
DecHexChr
8050P
DecHexChr
8151Q
DecHexChr
8252R
DecHexChr
8353S
DecHexChr
8454T
DecHexChr
8555U
DecHexChr
8656V
DecHexChr
8757W
DecHexChr
8858X
DecHexChr
8959Y
DecHexChr
905aZ
DecHexChr
955f_
DecHexChr
9761a
DecHexChr
9862b
DecHexChr
9963c
DecHexChr
10064d
DecHexChr
10165e
DecHexChr
10266f
DecHexChr
10367g
DecHexChr
10468h
DecHexChr
10569i
DecHexChr
1066aj
DecHexChr
1076bk
DecHexChr
1086cl
DecHexChr
1096dm
DecHexChr
1106en
DecHexChr
1116fo
DecHexChr
11270p
DecHexChr
11371q
DecHexChr
11472r
DecHexChr
11573s
DecHexChr
11674t
DecHexChr
11775u
DecHexChr
11876v
DecHexChr
11977w
DecHexChr
12078x
DecHexChr
12179y
DecHexChr
1227az
DecHexChr
1267e~
Chrome logo
Chrome 125.0.0.0 desktop macOS 10.15.7
Found 74 results
DecHexChr
3321!
DecHexChr
3624$
DecHexChr
3826&
DecHexChr
4028(
DecHexChr
4129)
DecHexChr
422a*
DecHexChr
432b+
DecHexChr
442c,
DecHexChr
452d-
DecHexChr
462e.
DecHexChr
48300
DecHexChr
49311
DecHexChr
50322
DecHexChr
51333
DecHexChr
52344
DecHexChr
53355
DecHexChr
54366
DecHexChr
55377
DecHexChr
56388
DecHexChr
57399
DecHexChr
6541A
DecHexChr
6642B
DecHexChr
6743C
DecHexChr
6844D
DecHexChr
6945E
DecHexChr
7046F
DecHexChr
7147G
DecHexChr
7248H
DecHexChr
7349I
DecHexChr
744aJ
DecHexChr
754bK
DecHexChr
764cL
DecHexChr
774dM
DecHexChr
784eN
DecHexChr
794fO
DecHexChr
8050P
DecHexChr
8151Q
DecHexChr
8252R
DecHexChr
8353S
DecHexChr
8454T
DecHexChr
8555U
DecHexChr
8656V
DecHexChr
8757W
DecHexChr
8858X
DecHexChr
8959Y
DecHexChr
905aZ
DecHexChr
955f_
DecHexChr
9761a
DecHexChr
9862b
DecHexChr
9963c
DecHexChr
10064d
DecHexChr
10165e
DecHexChr
10266f
DecHexChr
10367g
DecHexChr
10468h
DecHexChr
10569i
DecHexChr
1066aj
DecHexChr
1076bk
DecHexChr
1086cl
DecHexChr
1096dm
DecHexChr
1106en
DecHexChr
1116fo
DecHexChr
11270p
DecHexChr
11371q
DecHexChr
11472r
DecHexChr
11573s
DecHexChr
11674t
DecHexChr
11775u
DecHexChr
11876v
DecHexChr
11977w
DecHexChr
12078x
DecHexChr
12179y
DecHexChr
1227az
DecHexChr
1267e~
Safari logo
Safari 17.5 mobile iOS 17.5.1
Found 75 results
DecHexChr
3321!
DecHexChr
3624$
DecHexChr
3826&
DecHexChr
3927'
DecHexChr
4028(
DecHexChr
4129)
DecHexChr
422a*
DecHexChr
432b+
DecHexChr
442c,
DecHexChr
452d-
DecHexChr
462e.
DecHexChr
48300
DecHexChr
49311
DecHexChr
50322
DecHexChr
51333
DecHexChr
52344
DecHexChr
53355
DecHexChr
54366
DecHexChr
55377
DecHexChr
56388
DecHexChr
57399
DecHexChr
6541A
DecHexChr
6642B
DecHexChr
6743C
DecHexChr
6844D
DecHexChr
6945E
DecHexChr
7046F
DecHexChr
7147G
DecHexChr
7248H
DecHexChr
7349I
DecHexChr
744aJ
DecHexChr
754bK
DecHexChr
764cL
DecHexChr
774dM
DecHexChr
784eN
DecHexChr
794fO
DecHexChr
8050P
DecHexChr
8151Q
DecHexChr
8252R
DecHexChr
8353S
DecHexChr
8454T
DecHexChr
8555U
DecHexChr
8656V
DecHexChr
8757W
DecHexChr
8858X
DecHexChr
8959Y
DecHexChr
905aZ
DecHexChr
955f_
DecHexChr
9761a
DecHexChr
9862b
DecHexChr
9963c
DecHexChr
10064d
DecHexChr
10165e
DecHexChr
10266f
DecHexChr
10367g
DecHexChr
10468h
DecHexChr
10569i
DecHexChr
1066aj
DecHexChr
1076bk
DecHexChr
1086cl
DecHexChr
1096dm
DecHexChr
1106en
DecHexChr
1116fo
DecHexChr
11270p
DecHexChr
11371q
DecHexChr
11472r
DecHexChr
11573s
DecHexChr
11674t
DecHexChr
11775u
DecHexChr
11876v
DecHexChr
11977w
DecHexChr
12078x
DecHexChr
12179y
DecHexChr
1227az
DecHexChr
1267e~