NewShazzer now has an MCP server. Let Claude search, create and fuzz your vectors from Claude Desktop or Claude Code.Get an API key What's new

Mutating...

Characters allowed before image-set function

This vector shows what characters are allowed before the image-set() function with a nested url() function.

Shazzer Master

Created Aug 6, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style=background:$[chr]image-set(url(https://fuzz.shazzer.co.uk/$[rand]?$[i]#))>

Sample payloads

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/m5lrwfajjpn?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/6g1mfe9f7cc?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/b5g4luyvc5d?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/r462tjd98v?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/dm1qay6npwd?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/y5h00otama?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/5esmvn5axsh?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/agg6e2obca?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/0ofu089llf2?92#))>