char not urlencoded (data+)

char not URL-encoded (data+) - string

Created bynu11secur1ty

Created Sep 29, 2024

Updated May 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderall_browser_events

$[data2] placeholderall_browser_events

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint($[i]) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))log('$[data2]')

Sample payloads

anchor.href='http://example.com';0x0D
anchor.protocol = 'http' + String.fromCodePoint(0) + ':';0x0D
if(!/http:/.test(anchor.protocol+''))alert('')

char not urlencoded (data+)

Sample payloads

Fuzz results

Distributed Fuzzing