char not urlencoded (data)

This vector shows which characters are not encoded in the schema part of the URL. Log data

Created bynu11secur1ty

Created Sep 29, 2024

Updated May 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderall_browser_events

$[data2] placeholderall_browser_events

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint($[i]) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))log('$[data1]')

Sample payloads

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(0) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert('onpointercancel')

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(0) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert('ondeviceorientationabsolute')

char not urlencoded (data)

Sample payloads

Fuzz results

Distributed Fuzzing