Characters appended at the end of TLD within URL, which yield in the same Origin

Characters ignored in URL, which yield in the same Origin

Created by: hansmach1ne

Created on: Sunday, January 5, 2025 at 1:47:40 AM

Updated on: Wednesday, May 28, 2025 at 11:16:44 AM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:

if (new URL("https://google.com$[chr]$[chr]/endpoint").origin=="https://google.com"){log($[i])}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("https://google.com0x090x09/endpoint").origin=="https://google.com"){alert(9)}

if (new URL("https://google.com##/endpoint").origin=="https://google.com"){alert(35)}

if (new URL("https://google.com///endpoint").origin=="https://google.com"){alert(47)}

if (new URL("https://google.com??/endpoint").origin=="https://google.com"){alert(63)}

if (new URL("https://google.com\\/endpoint").origin=="https://google.com"){alert(92)}

if (new URL("https://google.com/endpoint").origin=="https://google.com"){alert(173)}

if (new URL("https://google.com͏͏/endpoint").origin=="https://google.com"){alert(847)}

if (new URL("https://google.comᅟᅟ/endpoint").origin=="https://google.com"){alert(4447)}

if (new URL("https://google.comᅠᅠ/endpoint").origin=="https://google.com"){alert(4448)}

if (new URL("https://google.com឴឴/endpoint").origin=="https://google.com"){alert(6068)}

if (new URL("https://google.com឵឵/endpoint").origin=="https://google.com"){alert(6069)}

if (new URL("https://google.com᠋᠋/endpoint").origin=="https://google.com"){alert(6155)}

if (new URL("https://google.com᠌᠌/endpoint").origin=="https://google.com"){alert(6156)}

if (new URL("https://google.com᠍᠍/endpoint").origin=="https://google.com"){alert(6157)}

if (new URL("https://google.com᠎᠎/endpoint").origin=="https://google.com"){alert(6158)}

if (new URL("https://google.com᠏᠏/endpoint").origin=="https://google.com"){alert(6159)}

if (new URL("https://google.com/endpoint").origin=="https://google.com"){alert(8203)}

if (new URL("https://google.com⁠⁠/endpoint").origin=="https://google.com"){alert(8288)}

if (new URL("https://google.com⁡⁡/endpoint").origin=="https://google.com"){alert(8289)}

if (new URL("https://google.com⁢⁢/endpoint").origin=="https://google.com"){alert(8290)}