Shazzer - Shared online fuzzing

- Home
- Login
- Vectors
- Unicode table
- Help
- Home
- Login
- Vectors
- Unicode table
- Help

Shazzer
Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes
Follow me on Twitter: @garethheyes

If you liked this, you may also like Hackvertor

New users

bugraesk lp-static stish834 geraldino2 UwimanaMuhiziElie dhrruvin comwrg tanto-noahc rozium reindaelman Blind2k MathzRocha kacpal SilverPoision lolkhan853 BuckLaFleur najam1997 nonc2 DenEnen Nokline

Popular users

hackvertor (30)renniepak (7)joaxcar (5)albinowax (4)masatokinugawa (3)0x999-x (2)d0ge (2)JorianWoltjer (2)DreyAnd (1)B-i-t-K (1)hansmach1ne (1)securaji (1)sqjor (1)ThomasOrlita (1)weizman (1)koto (1)InsertScript (1)vitorfhc (1)K4r1it0 (1)freddyb (1)

New vectors

Characters prepended to URL host. check if difference between URL and a tag Characters prepended to URL, which yield in the same host property Characters appended at the end of TLD within URL, which yield in the same host property Allowed characters right after tag name & before tag closure, no other characters in between Loose comparison, characters appended which still result in type coercion Difference between browser-supported handlers and Shazzer 'all_browser_events' list Difference between browser-supported handlers and Shazzer 'events' list Characters appended at the end of TLD within URL, which yield in the same Origin HTML TAGS Lists Bytes that will scramble ISO-2022-JP Bytes that will normalize ISO-2022-JP Characters allowed after equals sign for event Unicode characters that get normalized into path traversal characters ISO-2022-JP ASCII escape sequence Impossible lab frameset Find WAF bypass for eval context Characters transformed when using lowercase Characters transformed when using uppercase Chars in href that will not default to full URL Non-standard characters that break JSON.parse()

Most popular

URL domain dot alternatives (2334)DOM element relationships (2193)Characters between < and element name (2175)Characters allowed between hostname and / but don't change the hostname (2158)JavaScript Scheme starting with https:// (2065)Characters that can precede the javascript protocol (2012)Characters allowed javascript and colon copy2 (1919)< removal bypass (1746)Characters allowed javascript and colon (1695)characters allowed between exclamation mark and greater then (1664)Characters that close or encapsulate HTML attribute values (1636)Character that closes HTML tag (1515)Includes Validation Chars Allowed (1466)Entities that cause an external URL before @ (1432)XSS vectors that consume tag (1403)Characters allowed after hostname but don't change the hostname (1341)HTML entities that create ASCII characters inside a JavaScript URL (1335)All properties on navigator (two levels of nesting deep) (1328)Characters that can precede the javascript protocol copy2 (1212)Characters that cause exceptions when URL encoded (1190)

Most liked

URL domain dot alternatives (5)JavaScript Scheme starting with https:// (4)Characters allowed between hostname and / but don't change the hostname (4)Entities that cause an external URL before @ (4)Characters that can precede the javascript protocol (3)HTML entities that create ASCII characters inside a JavaScript URL (3)Characters allowed javascript and colon (3)Characters allowed between multiple HTML attributes (2)Characters that can be used as valid labels in JavaScript (2)Characters allowed in-between operators (2)Unicode characters that get normalized into path traversal characters (2)Characters that cause exceptions when URL encoded (2)Characters that cause an external URL before @ (2)HTML elements that are self closing or different text content (2)Characters allowed after optional chaining (2)Characters appended at the end of TLD within URL, which yield in the same Origin (2)XSS vectors that consume tag (2)Properties that contain URLs (2)Characters that can start an HTML comment (2)Characters allowed after hostname but don't change the hostname (2)