Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the src attribute.
<img $[chr]src=https://fuzz.shazzer.co.uk/$[rand]?$[i]><img 0x09src=https://fuzz.shazzer.co.uk/2tctvm1pjvc?9><img
src=https://fuzz.shazzer.co.uk/2fq6uas2ixj?10><img 0x0Csrc=https://fuzz.shazzer.co.uk/x91y5elox5g?12><img
src=https://fuzz.shazzer.co.uk/7wm4kzy4r0v?13><img src=https://fuzz.shazzer.co.uk/f1ud6e0i707?32><img /src=https://fuzz.shazzer.co.uk/455ea01psnu?47><img 0x09src=https://fuzz.shazzer.co.uk/ygl5i68olh?9><img
src=https://fuzz.shazzer.co.uk/xz93hegxmn?10><img 0x0Csrc=https://fuzz.shazzer.co.uk/d7yie5fktoo?12><img
src=https://fuzz.shazzer.co.uk/zfk4dx1b51?13><img src=https://fuzz.shazzer.co.uk/vk5ply8jk3d?32><img /src=https://fuzz.shazzer.co.uk/dti23v9w3d6?47><img 0x09src=https://fuzz.shazzer.co.uk/r2b181f7zng?9><img
src=https://fuzz.shazzer.co.uk/qajaebbeboq?10><img 0x0Csrc=https://fuzz.shazzer.co.uk/5dms3zu6zwx?12><img
src=https://fuzz.shazzer.co.uk/2u7z4krzfzu?13><img src=https://fuzz.shazzer.co.uk/eisf1jdb4n7?32><img /src=https://fuzz.shazzer.co.uk/aulm00brbm?47><img 0x09src=https://fuzz.shazzer.co.uk/2q266k8hgfg?9><img
src=https://fuzz.shazzer.co.uk/nh4o570upf?10>