Shazzer logo

Chars allowed before domain

Chrome logo 1
Firefox logo 1
Edge logo 1

Checks which characters are allowed before a domain name.

t0xodile
Created byt0xodile
Created Sep 24, 2024
Updated May 27, 2025

Tweet
Detecting browser...
CategoryURL Handling
VisibilityPublic
TypeXSS
CharsetUTF-8
Template used:
<a href="https://$[chr].example.com/" id="test$[i]"></a>
Code used after fuzz:
if(document.getElementById("test$[i]").href == "https://$[chr].example.com/"){log(document.getElementById("test$[i]").href)}

Sample payloads

<a href="https://0x00.example.com/" id="test0"></a>

Fuzz results

Chrome logo
Chrome 145.0.0.0 desktop Windows NT 10.0
Updated17 Feb 2026
Found 1 result
Loading...
Firefox logo
Firefox 148.0 desktop Windows NT 10.0
Updated23 Feb 2026
Found 1 result
Loading...
Edge logo
Microsoft Edge 145.0.0.0 desktop Windows NT 10.0
Updated18 Feb 2026
Found 1 result
Loading...