Leaking...

CSS escapes that cause an external request with a forward slash

⚠ Browser differences

Tests which escapes cause an external request within a CSS URL scheme for background images.

Shazzer Master

Created Aug 6, 2026

Updated Aug 28, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style="background:url(\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

Sample payloads

<div style="background:url(\00/fuzz.shazzer.co.uk/21k2nm1eaej?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/iouwxn3ie5s?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/1rq7235hjk8?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/cce087sbxhj?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/wl6xzzhgkd9?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/tb2cakhh99s?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/eyy89tn6b78?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/tibowx76sx?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/95tzbkxayv?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/mo67gluictm?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/n6lptetn3n?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/3io8l1iuvn5?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/yk4pu620fsp?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/mllsbv2wci?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/so1m3crnwva?00)">

<div style="background:url(\00/fuzz.shazzer.co.uk/nlndx0cwsmm?00)">