ToUpperCase Improper Character Morphing

Checks for any special characters which are converted to something else when uppercased.

Created byIDKdir

Created Jul 13, 2024

Updated May 27, 2025

Detecting browser...

CategoryJavaScript Syntax

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('$[chr]'.toUpperCase())) {0x0D
    log($[i]+' (normal) ($[chr] -> '+"$[chr]".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('$[chr]'.toLocaleUpperCase())) {0x0D
    log($[i]+' (locale) ($[chr] -> '+"$[chr]".toLocaleUpperCase()+')')0x0D
}

Sample payloads

var targets=['"','\'','<','/','>','\\']0x0D
if (targets.includes('0x00'.toUpperCase())) {0x0D
    alert(0+' (normal) (0x00 -> '+"0x00".toUpperCase()+')')0x0D
}0x0D
0x0D
if (targets.includes('0x00'.toLocaleUpperCase())) {0x0D
    alert(0+' (locale) (0x00 -> '+"0x00".toLocaleUpperCase()+')')0x0D
}

ToUpperCase Improper Character Morphing

Sample payloads

Fuzz results

Distributed Fuzzing