Non-standard characters that break JSON.parse()

Chrome logo 29

Characters that will break a JSON.parse() that do not include chars within standard JSON-format.

Created by: DreyAnd

Created on: Friday, November 15, 2024 at 12:28:16 AM

Updated on: Tuesday, December 10, 2024 at 4:52:48 PM

Vector type: JS

Vector charset: UTF-8

Template used:
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint($[i]))) { 
        JSON.parse(`{"test":"$[chr]"}`);
    }
} catch {
    log($[i]);
}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(0))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(0);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(1))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(1);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(2))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(2);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(3))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(3);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(4))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(4);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(5))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(5);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(6))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(6);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(7))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(7);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(8))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(8);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(11))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(11);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(12))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(12);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(14))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(14);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(15))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(15);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(16))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(16);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(17))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(17);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(18))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(18);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(19))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(19);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(20))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(20);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(21))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(21);
}
try {
    standard_chars = [
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`
    ];

    if (!standard_chars.includes(String.fromCodePoint(22))) { 
        JSON.parse(`{"test":""}`);
    }
} catch {
    alert(22);
}

Fuzz results

Chrome logo
Chrome 127.0.0.0 desktop Linux Unknown

Updated

Fri Nov 15 2024
Found 29 results
Loading...