Characters allowed in path traversal

Check which characters are allowed inside a path traversal and the URL still traverses

Created byjoaxcar

Created Aug 26, 2024

Updated May 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

new URL("https://x.se/long/..$[chr]/a").pathname.length > 4 ?  false : log($[i])

Sample payloads

new URL("https://x.se/long/..0x09/a").pathname.length > 4 ?  false : alert(9)

new URL("https://x.se/long/..#/a").pathname.length > 4 ?  false : alert(35)

new URL("https://x.se/long/..//a").pathname.length > 4 ?  false : alert(47)

new URL("https://x.se/long/..?/a").pathname.length > 4 ?  false : alert(63)

new URL("https://x.se/long/..\/a").pathname.length > 4 ?  false : alert(92)