Characters that cause an external URL before @

This vector shows what characters cause an external URL when used before an @

Created Sep 25, 2024

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href="https://psres.net"+String.fromCodePoint($[i])+"@example.com";0x0D
if(anchor.host !== 'example.com'){0x0D
    log($[i])0x0D
}

Sample payloads

anchor.href="https://psres.net"+String.fromCodePoint(35)+"@example.com";0x0D
if(anchor.host !== 'example.com'){0x0D
    alert(35)0x0D
}

anchor.href="https://psres.net"+String.fromCodePoint(47)+"@example.com";0x0D
if(anchor.host !== 'example.com'){0x0D
    alert(47)0x0D
}

anchor.href="https://psres.net"+String.fromCodePoint(63)+"@example.com";0x0D
if(anchor.host !== 'example.com'){0x0D
    alert(63)0x0D
}

anchor.href="https://psres.net"+String.fromCodePoint(92)+"@example.com";0x0D
if(anchor.host !== 'example.com'){0x0D
    alert(92)0x0D
}