Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".

Created byrootd4ddy

Created Mar 2, 2025

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("https://$[chr]localhost/endpoint").host == "localhost") {0x0D
    log($[i]);0x0D
}

Sample payloads

if (new URL("https://0x09localhost/endpoint").host == "localhost") {0x0D
    alert(9);0x0D
}

if (new URL("https:///localhost/endpoint").host == "localhost") {0x0D
    alert(47);0x0D
}

if (new URL("https://@localhost/endpoint").host == "localhost") {0x0D
    alert(64);0x0D
}

if (new URL("https://\localhost/endpoint").host == "localhost") {0x0D
    alert(92);0x0D
}

if (new URL("https://localhost/endpoint").host == "localhost") {0x0D
    alert(173);0x0D
}

if (new URL("https://͏localhost/endpoint").host == "localhost") {0x0D
    alert(847);0x0D
}

if (new URL("https://ᅟlocalhost/endpoint").host == "localhost") {0x0D
    alert(4447);0x0D
}

if (new URL("https://ᅠlocalhost/endpoint").host == "localhost") {0x0D
    alert(4448);0x0D
}

if (new URL("https://឴localhost/endpoint").host == "localhost") {0x0D
    alert(6068);0x0D
}

if (new URL("https://឵localhost/endpoint").host == "localhost") {0x0D
    alert(6069);0x0D
}

if (new URL("https://᠋localhost/endpoint").host == "localhost") {0x0D
    alert(6155);0x0D
}

if (new URL("https://᠌localhost/endpoint").host == "localhost") {0x0D
    alert(6156);0x0D
}

if (new URL("https://᠍localhost/endpoint").host == "localhost") {0x0D
    alert(6157);0x0D
}

if (new URL("https://᠎localhost/endpoint").host == "localhost") {0x0D
    alert(6158);0x0D
}

if (new URL("https://᠏localhost/endpoint").host == "localhost") {0x0D
    alert(6159);0x0D
}

if (new URL("https://localhost/endpoint").host == "localhost") {0x0D
    alert(8203);0x0D
}

if (new URL("https://⁠localhost/endpoint").host == "localhost") {0x0D
    alert(8288);0x0D
}

if (new URL("https://⁡localhost/endpoint").host == "localhost") {0x0D
    alert(8289);0x0D
}

if (new URL("https://⁢localhost/endpoint").host == "localhost") {0x0D
    alert(8290);0x0D
}

if (new URL("https://⁣localhost/endpoint").host == "localhost") {0x0D
    alert(8291);0x0D
}

Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

Sample payloads

Fuzz results

Distributed Fuzzing