Characters allowed in path traversal copy

Check which characters are allowed inside a path traversal and the URL still traverses

Created on: Monday, August 26, 2024 at 8:52:29 PM

Updated on: Sunday, September 8, 2024 at 10:55:59 AM

Vector type: JS

Template used:
new URL("https://x.se/long/.." + String.fromCharCode($[i]) + "/a").pathname.length > 4 ? false : log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

new URL("https://x.se/long/.." + String.fromCharCode(9) + "/a").pathname.length > 4 ? false : alert(9)new URL("https://x.se/long/.." + String.fromCharCode(10) + "/a").pathname.length > 4 ? false : alert(10)new URL("https://x.se/long/.." + String.fromCharCode(13) + "/a").pathname.length > 4 ? false : alert(13)new URL("https://x.se/long/.." + String.fromCharCode(35) + "/a").pathname.length > 4 ? false : alert(35)new URL("https://x.se/long/.." + String.fromCharCode(47) + "/a").pathname.length > 4 ? false : alert(47)new URL("https://x.se/long/.." + String.fromCharCode(63) + "/a").pathname.length > 4 ? false : alert(63)new URL("https://x.se/long/.." + String.fromCharCode(92) + "/a").pathname.length > 4 ? false : alert(92)

Fuzz results

Chrome 127.0.0.0 desktop Windows NT 10.0

Found 7 results

Show differences only?

Dec	Hex	Chr
9	09	HT

Dec	Hex	Chr
10	0a	LF

Dec	Hex	Chr
13	0d	CR

Dec	Hex	Chr
35	23	#

Dec	Hex	Chr
47	2f	/

Dec	Hex	Chr
63	3f	?

Dec	Hex	Chr
92	5c	\