CSS escapes that cause an external request with a forward slash

⚠ Browser differences

Tests which escapes cause an external request within a CSS URL scheme for background images.

Shazzer Master

Created Aug 6, 2026

Updated Aug 6, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

Sample payloads

<div style="background:url(\00/fuzz.shazzer.co.uk/lk3ow264fze?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/zciz69trwt?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/ndd679cars?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/0c9j02dhvld?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/iy9wbsoytxi?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/gg5f5fty0zo?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/hbcav2xoyu?00)">