Includes Validation Chars Allowed

Check for chars allowed before the string to validate.

Created bySimpsonpt

Created Oct 8, 2024

Updated May 28, 2025

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (['https:'].includes("$[chr]https:")){0x0D
    log($[i])0x0D
}

Sample payloads

if (['https:'].includes("\https:")){0x0D
    alert(92)0x0D
}