Harvesting...

Before URL protocol relative characters

Tests which characters can be used before a protocol relative URL within an HTML style attribute.

Shazzer Master

Created byhackvertor

Created Aug 27, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div id=x style="background:url($[chr]//fuzz.shazzer.co.uk/$[rand]?$[i]#)">test</div>

Sample payloads

<div id=x style="background:url(0x09//fuzz.shazzer.co.uk/rypef7k3wfc?9#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/3vwb6zoe0bd?10#)">test</div>

<div id=x style="background:url(0x0C//fuzz.shazzer.co.uk/8np9ss0b0fo?12#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/u5zg03a2h5m?13#)">test</div>

<div id=x style="background:url( //fuzz.shazzer.co.uk/k9lhrofthda?32#)">test</div>

<div id=x style="background:url('//fuzz.shazzer.co.uk/exb81eav73?39#)">test</div>

<div id=x style="background:url(///fuzz.shazzer.co.uk/dgal1a81uhs?47#)">test</div>

<div id=x style="background:url(\//fuzz.shazzer.co.uk/0rjdhp4zbw1?92#)">test</div>

<div id=x style="background:url(0x09//fuzz.shazzer.co.uk/zrxwckyzou?9#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/kogxallzqu9?10#)">test</div>

<div id=x style="background:url(0x0C//fuzz.shazzer.co.uk/8fdjbjyj7ya?12#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/hzqwsrh0fd?13#)">test</div>

<div id=x style="background:url( //fuzz.shazzer.co.uk/1awt15gtq5c?32#)">test</div>

<div id=x style="background:url('//fuzz.shazzer.co.uk/ova80m227d?39#)">test</div>

<div id=x style="background:url(///fuzz.shazzer.co.uk/wmi7vext9a?47#)">test</div>

<div id=x style="background:url(\//fuzz.shazzer.co.uk/eacjoonujgh?92#)">test</div>

<div id=x style="background:url(0x09//fuzz.shazzer.co.uk/9r9dejw16ym?9#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/oio2j71rzop?10#)">test</div>

<div id=x style="background:url(0x0C//fuzz.shazzer.co.uk/o1rzdqctlhn?12#)">test</div>

<div id=x style="background:url(
//fuzz.shazzer.co.uk/oco1zd71plq?13#)">test</div>