Sniffing...

CSS escapes that cause an external request with a forward slash

⚠ Browser differences

Tests which escapes cause an external request within a CSS URL scheme for background images.

Shazzer Master

Created byhackvertor

Created Aug 6, 2026

Updated Sep 8, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

Sample payloads

<div style="background:url(\00/fuzz.shazzer.co.uk/toqk685qhzo?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/41o2qvnk4st?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/fyg88n11tfp?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/u90fsag43k?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/t0x5o6xoxc?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/00y3syrna3cyc?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/33stshn019i?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/rg1l7vd9t7m?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/ld2nffyhew?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/7sjbjo0ijpu?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/vnxuc0yuda?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/1l9vhpvs47d?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/owjkz3tesi?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/k748ovdjo6p?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/xrvbfl5pu6m?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/ei67w6nt6hq?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/72evt8znctl?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/s52srmqi2np?00)">