Hacking...

Host

Testing

Fuzzer

Created byIDKdir

Created Jul 15, 2024

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL('https://www.example.com/$[chr]evil.com').host=='evil.com') {
    log('"https://www.example.com/$[chr]evil.com" -> "evil.com"')
}

if (new URL('https://www.example.com$[chr]evil.com').host=='evil.com') {
    log('"https://www.example.com$[chr]evil.com" -> "evil.com"')
}

Sample payloads

if (new URL('https://www.example.com/0x00evil.com').host=='evil.com') {
    alert('"https://www.example.com/0x00evil.com" -> "evil.com"')
}

if (new URL('https://www.example.com0x00evil.com').host=='evil.com') {
    alert('"https://www.example.com0x00evil.com" -> "evil.com"')
}