ToUpperCase Improper Character Morphing

Checks for any special characters which are converted to something else when uppercased.

Fuzzer

Created byIDKdir

Created Jul 13, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryJavaScript Syntax

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('$[chr]'.toUpperCase())) {0x0D
    log($[i]+' (normal) ($[chr] -> '+"$[chr]".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('$[chr]'.toLocaleUpperCase())) {0x0D
    log($[i]+' (locale) ($[chr] -> '+"$[chr]".toLocaleUpperCase()+')')0x0D
}

Sample payloads

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('0x00'.toUpperCase())) {0x0D
    alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('0x00'.toLocaleUpperCase())) {0x0D
    alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')0x0D
}

Distributed Fuzzing

ToUpperCase Improper Character Morphing

Sample payloads

Fuzz results