Injection in src attribute PORT, characters that change hostname

Created by: reindaelman

Created on: Sunday, June 15, 2025 at 6:15:55 PM

Updated on: Sunday, June 15, 2025 at 6:16:39 PM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:

try{
img = document.createElement("img");
img.src=`https://example.com:1$[chr]1`;
url = new URL(img.src);
if(url.hostname != "example.com"){
  log($[i]);
}
} catch{}

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

try{
img = document.createElement("img");
img.src=`https://example.com:1@1`;
url = new URL(img.src);
if(url.hostname != "example.com"){
  alert(64);
}
} catch{}

Injection in src attribute PORT, characters that change hostname

Sample payloads

Fuzz results