Shazzer logo

Chars allowed before domain

Edge logo 1
Chrome logo 1

Checks which characters are allowed before a domain name.

Created by: t0xodile

Created on: Tuesday, September 24, 2024 at 12:53:51 PM

Updated on: Tuesday, May 27, 2025 at 8:14:02 AM


Detecting browser...

Category: URL Handling

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:
<a href="https://$[chr].example.com/" id="test$[i]"></a>
Code used after fuzz:
if(document.getElementById("test$[i]").href == "https://$[chr].example.com/"){log(document.getElementById("test$[i]").href)}

Sample payloads

<a href="https://0x00.example.com/" id="test0"></a>

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop Windows NT 10.0

Updated

Sun Jan 25 2026
Found 1 result
Loading...
Edge logo
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0

Updated

Sat Jan 31 2026
Found 1 result
Loading...