Characters allowed in path traversal copy
Check which characters are allowed inside a path traversal and the URL still traverses
Created by: ThomasOrlita
Created on: Monday, August 26, 2024 at 8:52:29 PM
Updated on: Sunday, September 8, 2024 at 10:55:59 AM
Vector type: JS
Template used:
new URL("https://x.se/long/.." + String.fromCharCode($[i]) + "/a").pathname.length > 4 ? false : log($[i])
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
new URL("https://x.se/long/.." + String.fromCharCode(9) + "/a").pathname.length > 4 ? false : alert(9)
new URL("https://x.se/long/.." + String.fromCharCode(10) + "/a").pathname.length > 4 ? false : alert(10)
new URL("https://x.se/long/.." + String.fromCharCode(13) + "/a").pathname.length > 4 ? false : alert(13)
new URL("https://x.se/long/.." + String.fromCharCode(35) + "/a").pathname.length > 4 ? false : alert(35)
new URL("https://x.se/long/.." + String.fromCharCode(47) + "/a").pathname.length > 4 ? false : alert(47)
new URL("https://x.se/long/.." + String.fromCharCode(63) + "/a").pathname.length > 4 ? false : alert(63)
new URL("https://x.se/long/.." + String.fromCharCode(92) + "/a").pathname.length > 4 ? false : alert(92)
Fuzz results
Chrome 127.0.0.0 desktop Windows NT 10.0
Found 7 results
Dec | Hex | Chr |
---|---|---|
9 | 09 | HT |
Dec | Hex | Chr |
---|---|---|
10 | 0a | LF |
Dec | Hex | Chr |
---|---|---|
13 | 0d | CR |
Dec | Hex | Chr |
---|---|---|
35 | 23 | # |
Dec | Hex | Chr |
---|---|---|
47 | 2f | / |
Dec | Hex | Chr |
---|---|---|
63 | 3f | ? |
Dec | Hex | Chr |
---|---|---|
92 | 5c | \ |