Chars allowed before domain

Checks which characters are allowed before a domain name.

Novice Fuzzer

Created byt0xodile

The fuzzing network isn't running this vector

Reported as broken by 2 engines (Blink, Gecko) with no successful result. Editing the template, init or after code, type, charset or data references puts it back on the network.

Created Sep 24, 2024

Updated Aug 13, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a href="https://$[chr].example.com/" id="test$[i]"></a>

Code used after fuzz:

if(document.getElementById("test$[i]").href == "https://$[chr].example.com/"){log(document.getElementById("test$[i]").href)}

Sample payloads

<a href="https://0x00.example.com/" id="test0"></a>

Distributed Fuzzing

Chars allowed before domain

Sample payloads

Fuzz results