Characters allowed after colon which result in an external URL

This is an example how you can use the XSS type to fuzz URLs. It uses a base tag to get round the sandboxed iframe problems.

Shazzer Elite

Created Jan 16, 2025

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="https:$[chr]$[chr]example2.com" id=x></a>

Code used after fuzz:

x.protocol === 'https:' && x.host === "example2.com" && log($[i])

Sample payloads

<a href="https://example2.com" id=x></a>

<a href="https:\\example2.com" id=x></a>