Characters allowed in path traversal

Check which characters are allowed inside a path traversal and the URL still traverses

Created by: joaxcar

Created on: Monday, August 26, 2024 at 8:20:34 PM

Updated on: Tuesday, May 27, 2025 at 8:15:10 AM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:

new URL("https://x.se/long/..$[chr]/a").pathname.length > 4 ?  false : log($[i])

Detecting browser...

Sample payloads

new URL("https://x.se/long/..0x09/a").pathname.length > 4 ?  false : alert(9)

new URL("https://x.se/long/..#/a").pathname.length > 4 ?  false : alert(35)

new URL("https://x.se/long/..//a").pathname.length > 4 ?  false : alert(47)

new URL("https://x.se/long/..?/a").pathname.length > 4 ?  false : alert(63)

new URL("https://x.se/long/..\/a").pathname.length > 4 ?  false : alert(92)