Shazzer

Lexing...

Shared online fuzzer

Fuzzing browsers since 2012

Supported HTML and attributes by the Sanitizer
String concat vs array join
HTML TAGS Lists
Tags that get reordered in the DOM
Entities allowed before slashes which result in an external URL
Tags that get moved out of parent
Characters allowed after slashes which result in an external URL
Characters allowed after colon which result in an external URL
Characters allowed between slashes using XSS type
Characters prepended to URL host. check if difference between URL and a tag
Entities allowed between slashes using XSS type
Impossible lab frameset
HTML tags and attributes that can be used to access the URL
Allowed characters right after tag name & before tag closure, no other characters in between
Characters allowed after equals sign for event
Chars in href that will not default to full URL
document properties
Characters allowed between variable name and equals sign
Characters allowed instead of equal sign
All events on window

URL domain dot alternatives(7.9k)
Characters allowed javascript and colon(7.4k)
JavaScript Scheme starting with https://(7k)
Characters allowed between hostname and / but don't change the hostname(6.1k)
Characters between < and element name(6k)
HTML entities that create ASCII characters inside a JavaScript URL(5.9k)
DOM element relationships(5.8k)
Characters that can precede the javascript protocol(5.8k)
characters allowed between exclamation mark and greater then (5.2k)
Characters allowed javascript and colon copy2(5.2k)

URL domain dot alternatives(5)
Entities that cause an external URL before @(4)
Characters allowed between hostname and / but don't change the hostname(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between multiple HTML attributes(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Characters that can precede the javascript protocol(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

disconnected

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Shazzer - Shared online fuzzing