Characters allowed before host name that are ignored

⚠ Browser differences

This vectors show which characters are ignored at the start of the hostname.

Shazzer Master

Created Jun 11, 2025

Updated Aug 7, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="https://$[chr]example2.com" id=x></a>

Code used after fuzz:

x.host === "example2.com" && log($[i])

Sample payloads

<a href="https://0x09example2.com" id=x></a>

<a href="https://
example2.com" id=x></a>

<a href="https://0x0Dexample2.com" id=x></a>

<a href="https:///example2.com" id=x></a>

<a href="https://@example2.com" id=x></a>

<a href="https://\example2.com" id=x></a>

<a href="https://example2.com" id=x></a>

<a href="https://͏example2.com" id=x></a>

<a href="https://ᅟexample2.com" id=x></a>

<a href="https://ᅠexample2.com" id=x></a>

<a href="https://឴example2.com" id=x></a>

<a href="https://឵example2.com" id=x></a>

<a href="https://᠋example2.com" id=x></a>

<a href="https://᠌example2.com" id=x></a>

<a href="https://᠍example2.com" id=x></a>

<a href="https://᠎example2.com" id=x></a>

<a href="https://᠏example2.com" id=x></a>

<a href="https://example2.com" id=x></a>

<a href="https://⁠example2.com" id=x></a>

<a href="https://⁡example2.com" id=x></a>