Entities allowed between slashes using XSS type

This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.

Shazzer Master

Created Jan 16, 2025

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="/$[data1]/example2.com" id=x></a>

Code used after fuzz:

x.host === "example2.com" && log('$[data1]')

Sample payloads

<a href="/&bsol;/example2.com" id=x></a>

<a href="/&NewLine;/example2.com" id=x></a>

<a href="/&sol;/example2.com" id=x></a>

<a href="/&Tab;/example2.com" id=x></a>