Characters allowed before slashes which result in an external URL

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes characters before double slashes. It uses a base tag to get round the sandboxed iframe problems.

Created by: hackvertor

Created on: Thursday, January 16, 2025 at 7:02:19 PM

Updated on: Thursday, February 20, 2025 at 6:02:11 PM

Vector type: XSS

Vector charset: UTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>
<base href="https://example.com" />

Template used:
<a href="$[chr]//example2.com" id=x></a>

Code used after fuzz:
x.protocol === 'https:' && x.host === "example2.com" && log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href="//example2.com" id=x></a><a href=" //example2.com" id=x></a>

<a href="
//example2.com" id=x></a>

<a href="//example2.com" id=x></a><a href="//example2.com" id=x></a>

<a href="
//example2.com" id=x></a>

Characters allowed before slashes which result in an external URL

Sample payloads

Fuzz results