Clobbering...

Entities that are normalized for e

⚠ Browser differences

This vector shows which entities are normalized for the letter e.

Created byhackvertor

Created Jul 12, 2024

Updated May 27, 2025

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

const div = document.createElement('div')

Template used:

div.innerHTML='<a href="//$[data1]xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   log('$[data1]');0x0D
}

Sample payloads

div.innerHTML='<a href="//&ee;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&ee;');0x0D
}

div.innerHTML='<a href="//&Efr;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&Efr;');0x0D
}

div.innerHTML='<a href="//&efr;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&efr;');0x0D
}

div.innerHTML='<a href="//&Eopf;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&Eopf;');0x0D
}

div.innerHTML='<a href="//&eopf;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&eopf;');0x0D
}

div.innerHTML='<a href="//&escr;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&escr;');0x0D
}

div.innerHTML='<a href="//&Escr;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&Escr;');0x0D
}

div.innerHTML='<a href="//&expectation;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&expectation;');0x0D
}

div.innerHTML='<a href="//&exponentiale;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&exponentiale;');0x0D
}

div.innerHTML='<a href="//&ExponentialE;xample.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&ExponentialE;');0x0D
}