Entities allowed between slashes using XSS type

This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.

Created Jan 16, 2025

Updated May 27, 2025

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="/$[data1]/example2.com" id=x></a>

Code used after fuzz:

x.host === "example2.com" && log('$[data1]')

Sample payloads

<a href="/&bsol;/example2.com" id=x></a>

<a href="/&NewLine;/example2.com" id=x></a>

<a href="/&sol;/example2.com" id=x></a>

<a href="/&Tab;/example2.com" id=x></a>