Shazzer - Shared online fuzzing

Pwning...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

Characters allowed before image-set function
Escaped characters that cause an external request in-between forward slashes
Characters that act as hash in anchors
Characters that act as question mark in anchors
Characters that represent "e" in URL constructor host
Characters before @ in a URL constructor host
Characters ignored after param value in URL constructor
Characters ignored before param name in URL constructor
Characters ignored in pathname using a URL constructor
CSS :has() selector
startsWith vs regex
for loop vs forEach
indexOf vs includes
startsWith performance
CSS :is() selector
CSS container queries
Before URL protocol relative characters
String concat vs array join
Attributes that are also DOM properties
Supported HTML and attributes by the Sanitizer

New collections

CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

CSS random function
Before URL protocol relative characters
Characters before CSS property values
Characters in-between CSS property names
Test chars in js protocol
URL fuzzing SVG before href attribute
URL fuzzing attributes
character between url and ( for import
HTML tagName differences
HTML tag localName differences

Most Popular

URL domain dot alternatives(8.2k)
Characters allowed javascript and colon(7.5k)
JavaScript Scheme starting with https://(7.1k)
Characters allowed between hostname and / but don't change the hostname(6.2k)
Characters between < and element name(6.1k)
HTML entities that create ASCII characters inside a JavaScript URL(6k)
DOM element relationships(6k)
Characters that can precede the javascript protocol(5.9k)
characters allowed between exclamation mark and greater then (5.4k)
Characters allowed javascript and colon copy2(5.3k)

Most Liked

URL domain dot alternatives(5)
Characters that can precede the javascript protocol(4)
Characters allowed between multiple HTML attributes(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between hostname and / but don't change the hostname(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Entities that cause an external URL before @(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Shazzer - Shared online fuzzing