Entities allowed before slashes which result in an external URL

This is an example how you can use the XSS type to fuzz URLs. This one fuzzes entities before double slashes. It uses a base tag to get round the sandboxed iframe problems.

Created byhackvertor

Created Jan 16, 2025

Updated May 27, 2025

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="$[data1]//example2.com" id=x></a>

Code used after fuzz:

x.protocol === 'https:' && x.host === "example2.com" && log('$[data1]')

Sample payloads

<a href="&bsol;//example2.com" id=x></a>

<a href="&NewLine;//example2.com" id=x></a>

<a href="&sol;//example2.com" id=x></a>

<a href="&Tab;//example2.com" id=x></a>

Entities allowed before slashes which result in an external URL

Sample payloads

Fuzz results

Distributed Fuzzing