Polyglotting...

Characters allowed after slashes which result in an external URL

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters after double slashes. It uses a base tag to get round the sandboxed iframe problems.

Shazzer Master

Created byhackvertor

Created Jan 16, 2025

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>
<base href="https://example.com" />

Template used:

<a href="//$[chr]example2.com" id=x></a>

Code used after fuzz:

x.protocol === 'https:' && x.host === "example2.com" && log($[i])

Sample payloads

<a href="//0x09example2.com" id=x></a>

<a href="//
example2.com" id=x></a>

<a href="//
example2.com" id=x></a>

<a href="///example2.com" id=x></a>

<a href="//@example2.com" id=x></a>

<a href="//\example2.com" id=x></a>

<a href="//example2.com" id=x></a>

<a href="//͏example2.com" id=x></a>

<a href="//ᅟexample2.com" id=x></a>

<a href="//ᅠexample2.com" id=x></a>

<a href="//឴example2.com" id=x></a>

<a href="//឵example2.com" id=x></a>

<a href="//᠋example2.com" id=x></a>

<a href="//᠌example2.com" id=x></a>

<a href="//᠍example2.com" id=x></a>

<a href="//᠎example2.com" id=x></a>

<a href="//᠏example2.com" id=x></a>

<a href="//example2.com" id=x></a>

<a href="//⁠example2.com" id=x></a>

<a href="//⁡example2.com" id=x></a>