Characters allowed in path traversal

Check which characters are allowed inside a path traversal and the URL still traverses

Novice Fuzzer

Created byjoaxcar

Created Aug 26, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

new URL("https://x.se/long/..$[chr]/a").pathname.length > 4 ?  false : log($[i])

Sample payloads

new URL("https://x.se/long/..0x09/a").pathname.length > 4 ?  false : alert(9)

new URL("https://x.se/long/..#/a").pathname.length > 4 ?  false : alert(35)

new URL("https://x.se/long/..//a").pathname.length > 4 ?  false : alert(47)

new URL("https://x.se/long/..?/a").pathname.length > 4 ?  false : alert(63)

new URL("https://x.se/long/..\/a").pathname.length > 4 ?  false : alert(92)