Scanning...

CSS hex escapes that cause an external request in-between forward slashes

⚠ Browser differences

Tests which escapes cause an external request in-between forward slashes within a CSS URL scheme for background images.

Shazzer Master

Created byhackvertor

Created Aug 6, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div style="background:url(/\$[hex2]/fuzz.shazzer.co.uk/$[rand]?$[hex2])">

Sample payloads

<div style="background:url(/\09/fuzz.shazzer.co.uk/bs7sta6ufre?09)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/tkwvv0r9qp?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/t7pnkus8uyn?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/bofgey0tokt?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/d44g9nflx7?00)">

<div style="background:url(/\09/fuzz.shazzer.co.uk/ow36l572o?09)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/8jmjffmgwfo?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/siqm9pi0unb?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/373clyyrph8?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/gvdrk8ick0m?00)">

<div style="background:url(/\09/fuzz.shazzer.co.uk/avjudj8sdc?09)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/myt9ank1rir?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/ihhs21lk7gp?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/die1mc38kpl?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/gcdmkfxrtpc?00)">

<div style="background:url(/\09/fuzz.shazzer.co.uk/rvbtk2s2qp?09)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/oiz4hqor9ss?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/jhhkrg5k9v?00)">

<div style="background:url(/\00/fuzz.shazzer.co.uk/u06zjer02dp?00)">

<div style="background:url(/\09/fuzz.shazzer.co.uk/h4pvi6lmp28?09)">