Characters urlencoded that get transformed when using the credentials part of the URL



This vector shows which characters that are URL decoded in the credentials part
Created by: hackvertor
Created on: Tuesday, September 24, 2024 at 9:17:56 AM
Updated on: Friday, February 7, 2025 at 11:47:03 AM
Vector type: JS
Vector charset: UTF-8
Code used before fuzz:
const anchor = document.createElement('a');
Template used:
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint($[i]));
if(!/%/.test(anchor+''))log($[i])
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(33));
if(!/%/.test(anchor+''))alert(33)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(40));
if(!/%/.test(anchor+''))alert(40)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(41));
if(!/%/.test(anchor+''))alert(41)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(42));
if(!/%/.test(anchor+''))alert(42)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(45));
if(!/%/.test(anchor+''))alert(45)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(46));
if(!/%/.test(anchor+''))alert(46)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(48));
if(!/%/.test(anchor+''))alert(48)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(49));
if(!/%/.test(anchor+''))alert(49)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(50));
if(!/%/.test(anchor+''))alert(50)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(51));
if(!/%/.test(anchor+''))alert(51)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(52));
if(!/%/.test(anchor+''))alert(52)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(53));
if(!/%/.test(anchor+''))alert(53)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(54));
if(!/%/.test(anchor+''))alert(54)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(55));
if(!/%/.test(anchor+''))alert(55)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(56));
if(!/%/.test(anchor+''))alert(56)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(57));
if(!/%/.test(anchor+''))alert(57)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(65));
if(!/%/.test(anchor+''))alert(65)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(66));
if(!/%/.test(anchor+''))alert(66)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(67));
if(!/%/.test(anchor+''))alert(67)
anchor.href='//example.com';
anchor.username = encodeURIComponent(String.fromCodePoint(68));
if(!/%/.test(anchor+''))alert(68)
Fuzz results

Chrome 129.0.0.0 desktop macOS 10.15.7
Updated
Tue Sep 24 2024
Found 70 results
Loading...

Firefox 130.0 desktop macOS 10.15
Updated
Tue Sep 24 2024
Found 71 results
Loading...

Safari 18.0 desktop macOS 10.15.7
Updated
Tue Sep 24 2024
Found 71 results
Loading...