Smashing...

Characters after https URI scheme which prevent URL parsing of href

⚠ Browser differences

These characters make the URI scheme parsing break and return plaintext instead of the parsed URL.

Created Oct 27, 2025

Updated Oct 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a id="user_id" href="https:$[chr]blah/../../"></a>

Code used after fuzz:

var user_id = document.getElementById("user_id");0x0D
var url = user_id.toString();0x0D
0x0D
if(url.indexOf("../") != -1) log($[i]);

Sample payloads

<a id="user_id" href="https:#blah/../../"></a>

<a id="user_id" href="https:%blah/../../"></a>

<a id="user_id" href="https:*blah/../../"></a>

<a id="user_id" href="https::blah/../../"></a>

<a id="user_id" href="https:<blah/../../"></a>

<a id="user_id" href="https:[blah/../../"></a>

<a id="user_id" href="https:|blah/../../"></a>

<a id="user_id" href="https:¨blah/../../"></a>

<a id="user_id" href="https:¯blah/../../"></a>

<a id="user_id" href="https:´blah/../../"></a>

<a id="user_id" href="https:¸blah/../../"></a>

<a id="user_id" href="https:΋blah/../../"></a>

<a id="user_id" href="https:΍blah/../../"></a>

<a id="user_id" href="https:΢blah/../../"></a>

<a id="user_id" href="https:԰blah/../../"></a>

<a id="user_id" href="https:؈blah/../../"></a>

<a id="user_id" href="https:؋blah/../../"></a>

<a id="user_id" href="https:؍blah/../../"></a>

<a id="user_id" href="https:঩blah/../../"></a>