Characters allowed after slashes which result in an external URL

⚠ Browser differences

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.

Created byhackvertor

Created Jan 16, 2025

Updated May 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="//$[chr]example2.com" id=x></a>

Code used after fuzz:

x.protocol === 'https:' && x.host === "example2.com" && log($[i])

Sample payloads

<a href="//0x09example2.com" id=x></a>

<a href="//
example2.com" id=x></a>

<a href="//0x0Dexample2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="//@example2.com" id=x></a>

<a href="//\example2.com" id=x></a>

<a href="//example2.com" id=x></a>

<a href="//͏example2.com" id=x></a>

<a href="//ᅟexample2.com" id=x></a>

<a href="//ᅠexample2.com" id=x></a>

<a href="//឴example2.com" id=x></a>

<a href="//឵example2.com" id=x></a>

<a href="//᠋example2.com" id=x></a>

<a href="//᠌example2.com" id=x></a>

<a href="//᠍example2.com" id=x></a>

<a href="//᠎example2.com" id=x></a>

<a href="//᠏example2.com" id=x></a>

<a href="//example2.com" id=x></a>

<a href="//⁠example2.com" id=x></a>

<a href="//⁡example2.com" id=x></a>

Characters allowed after slashes which result in an external URL

Sample payloads

Fuzz results

Distributed Fuzzing