Rebinding...

Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".

Novice Fuzzer

Created byrootd4ddy

Created Mar 2, 2025

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("https://$[chr]localhost/endpoint").host == "localhost") {0x0D
    log($[i]);0x0D
}

Sample payloads

if (new URL("https://0x09localhost/endpoint").host == "localhost") {0x0D
    alert(9);0x0D
}

if (new URL("https:///localhost/endpoint").host == "localhost") {0x0D
    alert(47);0x0D
}

if (new URL("https://@localhost/endpoint").host == "localhost") {0x0D
    alert(64);0x0D
}

if (new URL("https://\localhost/endpoint").host == "localhost") {0x0D
    alert(92);0x0D
}

if (new URL("https://localhost/endpoint").host == "localhost") {0x0D
    alert(173);0x0D
}

if (new URL("https://͏localhost/endpoint").host == "localhost") {0x0D
    alert(847);0x0D
}

if (new URL("https://ᅟlocalhost/endpoint").host == "localhost") {0x0D
    alert(4447);0x0D
}

if (new URL("https://ᅠlocalhost/endpoint").host == "localhost") {0x0D
    alert(4448);0x0D
}

if (new URL("https://឴localhost/endpoint").host == "localhost") {0x0D
    alert(6068);0x0D
}

if (new URL("https://឵localhost/endpoint").host == "localhost") {0x0D
    alert(6069);0x0D
}

if (new URL("https://᠋localhost/endpoint").host == "localhost") {0x0D
    alert(6155);0x0D
}

if (new URL("https://᠌localhost/endpoint").host == "localhost") {0x0D
    alert(6156);0x0D
}

if (new URL("https://᠍localhost/endpoint").host == "localhost") {0x0D
    alert(6157);0x0D
}

if (new URL("https://᠎localhost/endpoint").host == "localhost") {0x0D
    alert(6158);0x0D
}

if (new URL("https://᠏localhost/endpoint").host == "localhost") {0x0D
    alert(6159);0x0D
}

if (new URL("https://localhost/endpoint").host == "localhost") {0x0D
    alert(8203);0x0D
}

if (new URL("https://⁠localhost/endpoint").host == "localhost") {0x0D
    alert(8288);0x0D
}

if (new URL("https://⁡localhost/endpoint").host == "localhost") {0x0D
    alert(8289);0x0D
}

if (new URL("https://⁢localhost/endpoint").host == "localhost") {0x0D
    alert(8290);0x0D
}

if (new URL("https://⁣localhost/endpoint").host == "localhost") {0x0D
    alert(8291);0x0D
}

Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost - Shazzer

Distributed Fuzzing

Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

Sample payloads

Fuzz results