Characters not urlencoded when using the shema part of the URL

This vector shows which characters are not encoded in the schema part of the URL.

Created by: d0ge

Created on: Tuesday, September 24, 2024 at 9:24:15 AM

Updated on: Thursday, September 26, 2024 at 9:29:18 PM

Vector type: JS

Code used before fuzz:
const anchor = document.createElement('a');

Template used:

anchor.href='http://example.com';
anchor.protocol = 'http' + String.fromCodePoint($[i]) + ':';
if(!/http:/.test(anchor.protocol+''))log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

anchor.href='http://example.com';
anchor.protocol = 'http' + String.fromCodePoint(83) + ':';
if(!/http:/.test(anchor.protocol+''))alert(83)

anchor.href='http://example.com';
anchor.protocol = 'http' + String.fromCodePoint(115) + ':';
if(!/http:/.test(anchor.protocol+''))alert(115)

Safari 17.6 desktop macOS 10.15.7

Tue Sep 24 2024

Found 2 results

Show differences only?

Filter out alphanumeric

Dec	Hex	Chr
83	53	S

Dec	Hex	Chr
115	73	s

Firefox 130.0 desktop macOS 10.15

Tue Sep 24 2024

Found 2 results

Show differences only?

Filter out alphanumeric

Dec	Hex	Chr
83	53	S

Dec	Hex	Chr
115	73	s

Chrome 129.0.0.0 desktop macOS 10.15.7

Tue Sep 24 2024

Found 2 results

Show differences only?

Filter out alphanumeric

Dec	Hex	Chr
83	53	S

Dec	Hex	Chr
115	73	s