Includes Validation Chars Allowed

Check for chars allowed before the string to validate.

Novice Fuzzer

Created bySimpsonpt

Created Oct 8, 2024

Updated May 28, 2025

Unable to render tweet button

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (['https:'].includes("$[chr]https:")){0x0D
    log($[i])0x0D
}

Sample payloads

if (['https:'].includes("\https:")){0x0D
    alert(92)0x0D
}