Uses CSP violations to determine if external resources have been requested. This fuzzes characters before the href attribute in SVG.
<svg><image $[chr]href="https://fuzz.shazzer.co.uk/$[rand]?$[i]" /></svg><svg><image 0x09href="https://fuzz.shazzer.co.uk/971j650wp75?9" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/bvgplgptkza?10" /></svg><svg><image 0x0Chref="https://fuzz.shazzer.co.uk/bgl6jn57wts?12" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/8znmxzkyuwl?13" /></svg><svg><image href="https://fuzz.shazzer.co.uk/iyztj94kl7m?32" /></svg><svg><image /href="https://fuzz.shazzer.co.uk/xl42golrkaa?47" /></svg><svg><image 0x09href="https://fuzz.shazzer.co.uk/ob24gab8rwn?9" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/xxh87k3mxy?10" /></svg><svg><image 0x0Chref="https://fuzz.shazzer.co.uk/qqy9r2po1z?12" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/0y7lv5bqix9?13" /></svg><svg><image href="https://fuzz.shazzer.co.uk/7ffvu3d0vgb?32" /></svg><svg><image /href="https://fuzz.shazzer.co.uk/b4h1oiu08sg?47" /></svg><svg><image 0x09href="https://fuzz.shazzer.co.uk/99uludjxv6n?9" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/0t3r5g8gs7js?10" /></svg><svg><image 0x0Chref="https://fuzz.shazzer.co.uk/wla3jmlzhg?12" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/78wrqs8rtzx?13" /></svg><svg><image href="https://fuzz.shazzer.co.uk/j7rygmv6d5g?32" /></svg><svg><image /href="https://fuzz.shazzer.co.uk/vl51ntl0gv?47" /></svg><svg><image 0x09href="https://fuzz.shazzer.co.uk/j0rrxqhzd2?9" /></svg><svg><image
href="https://fuzz.shazzer.co.uk/b5bqntbyi7s?10" /></svg>