Shazzer logo

    Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

    Chrome logo 30

    This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".

    Created by: rootd4ddy

    Created on: Sunday, March 2, 2025 at 1:36:45 AM

    Updated on: Wednesday, April 9, 2025 at 10:30:36 PM

    Vector type: JS

    Vector charset: UTF-8

    Template used:
    if (new URL("https://$[chr]localhost/endpoint").host == "localhost") {
    log($[i]);
}
    Your browser was detected as:
    Detecting... Detecting... Detecting... Detecting...

    Sample payloads

    if (new URL("https://	localhost/endpoint").host == "localhost") {
    alert(9);
}
    if (new URL("https:///localhost/endpoint").host == "localhost") {
    alert(47);
}
    if (new URL("https://@localhost/endpoint").host == "localhost") {
    alert(64);
}
    if (new URL("https://\localhost/endpoint").host == "localhost") {
    alert(92);
}
    if (new URL("https://­localhost/endpoint").host == "localhost") {
    alert(173);
}
    if (new URL("https://͏localhost/endpoint").host == "localhost") {
    alert(847);
}
    if (new URL("https://᠋localhost/endpoint").host == "localhost") {
    alert(6155);
}
    if (new URL("https://᠌localhost/endpoint").host == "localhost") {
    alert(6156);
}
    if (new URL("https://᠍localhost/endpoint").host == "localhost") {
    alert(6157);
}
    if (new URL("https://᠏localhost/endpoint").host == "localhost") {
    alert(6159);
}
    if (new URL("https://​localhost/endpoint").host == "localhost") {
    alert(8203);
}
    if (new URL("https://⁠localhost/endpoint").host == "localhost") {
    alert(8288);
}
    if (new URL("https://⁤localhost/endpoint").host == "localhost") {
    alert(8292);
}
    if (new URL("https://︀localhost/endpoint").host == "localhost") {
    alert(65024);
}
    if (new URL("https://︁localhost/endpoint").host == "localhost") {
    alert(65025);
}
    if (new URL("https://︂localhost/endpoint").host == "localhost") {
    alert(65026);
}
    if (new URL("https://︃localhost/endpoint").host == "localhost") {
    alert(65027);
}
    if (new URL("https://︄localhost/endpoint").host == "localhost") {
    alert(65028);
}
    if (new URL("https://︅localhost/endpoint").host == "localhost") {
    alert(65029);
}
    if (new URL("https://︆localhost/endpoint").host == "localhost") {
    alert(65030);
}

    Fuzz results

    Chrome logo
    Chrome 132.0.0.0 desktop Linux Unknown

    Updated

    Sun Mar 02 2025
    Found 30 results
    Loading...