Characters allowed in path traversal

Check which characters are allowed inside a path traversal and the URL still traverses

Created by: joaxcar

Created on: Monday, August 26, 2024 at 8:20:34 PM

Updated on: Tuesday, May 27, 2025 at 8:15:10 AM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:
new URL("https://x.se/long/..$[chr]/a").pathname.length > 4 ? false : log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

new URL("https://x.se/long/.. /a").pathname.length > 4 ? false : alert(9)new URL("https://x.se/long/..#/a").pathname.length > 4 ? false : alert(35)new URL("https://x.se/long/..//a").pathname.length > 4 ? false : alert(47)new URL("https://x.se/long/..?/a").pathname.length > 4 ? false : alert(63)new URL("https://x.se/long/..\/a").pathname.length > 4 ? false : alert(92)

Characters allowed in path traversal

Sample payloads

Fuzz results