Characters allowed before url function with @import

This vector shows which characters are allowed before an URL function after the @import statement.

Shazzer Master

Created byhackvertor

Created Aug 6, 2026

Updated Aug 6, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint($[i])+'url("https://fuzz.shazzer.co.uk/$[rand]?$[i]");';0x0D
document.head.appendChild(style);

Sample payloads

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(9)+'url("https://fuzz.shazzer.co.uk/dd9v8j8nnke?9");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(10)+'url("https://fuzz.shazzer.co.uk/r80lpiymgs?10");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(12)+'url("https://fuzz.shazzer.co.uk/dg0wgpd00ho?12");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(13)+'url("https://fuzz.shazzer.co.uk/di0m81p5d85?13");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(32)+'url("https://fuzz.shazzer.co.uk/aa10dfldvgu?32");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(9)+'url("https://fuzz.shazzer.co.uk/qygl2foh94?9");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(10)+'url("https://fuzz.shazzer.co.uk/do2il9wkkil?10");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(12)+'url("https://fuzz.shazzer.co.uk/pfhc9o68xsr?12");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(13)+'url("https://fuzz.shazzer.co.uk/53fuxg81hnp?13");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(32)+'url("https://fuzz.shazzer.co.uk/yjg4gn7ma6n?32");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(9)+'url("https://fuzz.shazzer.co.uk/ynu8u1jq08?9");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(10)+'url("https://fuzz.shazzer.co.uk/452aiirv08e?10");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(12)+'url("https://fuzz.shazzer.co.uk/ed3nz0mwbs?12");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(13)+'url("https://fuzz.shazzer.co.uk/dy6anuf0vz?13");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(32)+'url("https://fuzz.shazzer.co.uk/0nv8hm5pic2q?32");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(9)+'url("https://fuzz.shazzer.co.uk/7lrz924gv3g?9");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(10)+'url("https://fuzz.shazzer.co.uk/9rllmy0bo5c?10");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(12)+'url("https://fuzz.shazzer.co.uk/od14yeljv3?12");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(13)+'url("https://fuzz.shazzer.co.uk/b9i3h8j28cu?13");';0x0D
document.head.appendChild(style);

const style = document.createElement("style");0x0D
style.textContent = '@import'+String.fromCodePoint(32)+'url("https://fuzz.shazzer.co.uk/3jsdyxlcsnn?32");';0x0D
document.head.appendChild(style);

Distributed Fuzzing

Characters allowed before url function with @import

Sample payloads

Fuzz results