Characters urlencoded that get transformed when using the credentials part of the URL

⚠ Browser differences

This vector shows which characters that are URL decoded in the credentials part

Created by: hackvertor

Created on: Tuesday, September 24, 2024 at 9:17:56 AM

Updated on: Tuesday, May 27, 2025 at 3:34:46 PM

Detecting browser...

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint($[i]));0x0D
if(!/%/.test(anchor+''))log($[i])

Sample payloads

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(33));0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(39));0x0D
if(!/%/.test(anchor+''))alert(39)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(40));0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(41));0x0D
if(!/%/.test(anchor+''))alert(41)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(42));0x0D
if(!/%/.test(anchor+''))alert(42)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(45));0x0D
if(!/%/.test(anchor+''))alert(45)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(46));0x0D
if(!/%/.test(anchor+''))alert(46)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(48));0x0D
if(!/%/.test(anchor+''))alert(48)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(49));0x0D
if(!/%/.test(anchor+''))alert(49)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(50));0x0D
if(!/%/.test(anchor+''))alert(50)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(51));0x0D
if(!/%/.test(anchor+''))alert(51)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(52));0x0D
if(!/%/.test(anchor+''))alert(52)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(53));0x0D
if(!/%/.test(anchor+''))alert(53)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(54));0x0D
if(!/%/.test(anchor+''))alert(54)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(55));0x0D
if(!/%/.test(anchor+''))alert(55)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(56));0x0D
if(!/%/.test(anchor+''))alert(56)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(57));0x0D
if(!/%/.test(anchor+''))alert(57)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(65));0x0D
if(!/%/.test(anchor+''))alert(65)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(66));0x0D
if(!/%/.test(anchor+''))alert(66)