Forking...

Characters allowed before image-set function

This vector shows what characters are allowed before the image-set() function with a nested url() function.

Shazzer Master

Created byhackvertor

Created Aug 6, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style=background:$[chr]image-set(url(https://fuzz.shazzer.co.uk/$[rand]?$[i]#))>

Sample payloads

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/qsdiav6gigi?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/pldn9yeo13?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/qhc29a00ua?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/bfemfo4dk0k?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/yiekvlm2jdf?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/nslf4aukxqh?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/0pyvmnlg5jv?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/iuo39gqjlrq?92#))>

<div style=background:\image-set(url(https://fuzz.shazzer.co.uk/1lhrcgpn4vkj?92#))>