Traversing...

CSS escapes that cause an external request with a forward slash

⚠ Browser differences

Tests which escapes cause an external request within a CSS URL scheme for background images.

Shazzer Master

Created byhackvertor

Created Aug 6, 2026

Updated Sep 8, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

Sample payloads

<div style="background:url(\00/fuzz.shazzer.co.uk/uklmwklay5r?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/bfdx88hfhe?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/dnkp4q4p7as?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/pq9duhe8ot?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/4qgacifkb8c?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/1brsr4lx31f?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/xvpx2gcynw8?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/oujuujttuc8?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/qagj9fwn1p?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/7d7ewo9n1f4?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/vvww0t165p?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/58yren0mzcv?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/v7botdh5hnq?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/ee5hisu9nwt?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/5dswlzf9sb8?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/92dx379sv5t?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/wtlm39owq2i?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/9b27yazzhh?00)">