HTML tags and attributes that can be used to access the URL

This vector shows which html tags/attributes can be used to access the url of the current page

Fuzzer

Created by0x999-x

Created Nov 4, 2024

Updated Aug 7, 2026

Unable to render tweet button

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml

$[data2] placeholderattributes

Template used:

<$[data1] id="x" $[data2]="#">

Code used after fuzz:

if(x.$[data2].includes("shazzer")){log('$[data1] $[data2]')}

Sample payloads

<a href id="x" ="#">

<area href id="x" ="#">

<audio src id="x" ="#">

<blockquote cite id="x" ="#">

<del cite id="x" ="#">

<embed src id="x" ="#">

<form action id="x" ="#">

<iframe src id="x" ="#">

<img src id="x" ="#">

<input src id="x" ="#">

<ins cite id="x" ="#">

<link href id="x" ="#">

<object data id="x" ="#">

<q cite id="x" ="#">

<script src id="x" ="#">

<source src id="x" ="#">

<track src id="x" ="#">

<video poster id="x" ="#">

<video src id="x" ="#">

<base href id="x" ="#">