Rendering...

Characters that can work as attribute seperator

This vector shows which characters can be used instead of the normal space to work as an attribute seperator

Novice Fuzzer

Created bySudistark

Created Aug 17, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

var markup = `<a$[chr]id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     log($[i])
 }

Sample payloads

var markup = `<a0x09id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(9)
 }

var markup = `<a
id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(10)
 }

var markup = `<a0x0Cid=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(12)
 }

var markup = `<a
id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(13)
 }

var markup = `<a id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(32)
 }

var markup = `<a/id=xss>shirley</a>`
var dom = new DOMParser().parseFromString(markup,'text/html')

if(dom.getElementById('xss')){
     alert(47)
 }