Characters that cause an external URL before @

This vector shows what characters cause an external URL when used before an @

Shazzer Master

Created Sep 25, 2024

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href="https://psres.net"+String.fromCodePoint($[i])+"@example.com";
if(anchor.host !== 'example.com'){
    log($[i])
}

Sample payloads

anchor.href="https://psres.net"+String.fromCodePoint(35)+"@example.com";
if(anchor.host !== 'example.com'){
    alert(35)
}

anchor.href="https://psres.net"+String.fromCodePoint(47)+"@example.com";
if(anchor.host !== 'example.com'){
    alert(47)
}

anchor.href="https://psres.net"+String.fromCodePoint(63)+"@example.com";
if(anchor.host !== 'example.com'){
    alert(63)
}

anchor.href="https://psres.net"+String.fromCodePoint(92)+"@example.com";
if(anchor.host !== 'example.com'){
    alert(92)
}