Enumerating...

Characters urlencoded that get transformed when using the credentials part of the URL

⚠ Browser differences

This vector shows which characters that are URL decoded in the credentials part

Shazzer Master

Created byhackvertor

Created Sep 24, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint($[i]));
if(!/%/.test(anchor+''))log($[i])

Sample payloads

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(33));
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(40));
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(41));
if(!/%/.test(anchor+''))alert(41)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(42));
if(!/%/.test(anchor+''))alert(42)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(45));
if(!/%/.test(anchor+''))alert(45)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(46));
if(!/%/.test(anchor+''))alert(46)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(48));
if(!/%/.test(anchor+''))alert(48)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(49));
if(!/%/.test(anchor+''))alert(49)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(50));
if(!/%/.test(anchor+''))alert(50)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(51));
if(!/%/.test(anchor+''))alert(51)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(52));
if(!/%/.test(anchor+''))alert(52)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(53));
if(!/%/.test(anchor+''))alert(53)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(54));
if(!/%/.test(anchor+''))alert(54)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(55));
if(!/%/.test(anchor+''))alert(55)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(56));
if(!/%/.test(anchor+''))alert(56)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(57));
if(!/%/.test(anchor+''))alert(57)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(65));
if(!/%/.test(anchor+''))alert(65)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(66));
if(!/%/.test(anchor+''))alert(66)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(67));
if(!/%/.test(anchor+''))alert(67)

anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(68));
if(!/%/.test(anchor+''))alert(68)