- Home
- Blog
  - Blog home
  - RSS
- Login
- Vectors
- Unicode table
- Help
- Home
- Blog
  - Blog home
  - RSS
- Login
- Vectors
- Unicode table
- Help

Vector categories

Character Encoding

JavaScript Syntax

Shazzer
Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes
Follow me on Twitter: @garethheyes

New users

elvar333 ZeyadZonkorany ShanksGGW Fabertvarico sttuartt Lkinneer hyuunnn nt0xa rafax00 phatdz159 itsryuku Rhynorater saltify7 SefeinSaeed YM0124MY behroozgholizade2-lab shidor4585 saminor masina-inf hackhavenpouria-crypto

Popular users

hackvertor (36)renniepak (8)albinowax (5)JorianWoltjer (5)joaxcar (5)0x999-x (4)RenwaX23 (3)masatokinugawa (3)d0ge (2)DreyAnd (1)B-i-t-K (1)hansmach1ne (1)securaji (1)jonathann403 (1)koto (1)ThomasOrlita (1)weizman (1)InsertScript (1)K4r1it0 (1)sqjor (1)

Recently updated vectors

Consuming tags Characters that can be inserted in the middle of the JS protocol name Characters allowed before javascript URL Characters between < and element name Entities still parsed in uppercase Characters allowed before CSS selectors Entities that convert to less than in a iframe srcdoc URL domain dot alternatives Characters allowed between multiple HTML attributes Entities that cause an external URL before @Characters that can be inside the javascript protocol Characters that starts element name Characters encoded by escape()Named HTML entities that can be closed with !Closing title tag name separators

New vectors

dsqd Closing title tag name separators masato - braves parsing finding entity test masato - braves parsing finding valid characters masato - braves parsing finding valid attributes masato - braves parsing finding Named HTML entities that can be closed with !Characters cause self closing tag Characters ignored following slash in self closing tag Characters allowed inside javascript protocol and still returns the hostname Characters allowed after a bigint Characters allowed either side of a variable assignment Characters allowed after throw statement encodeURI() not encoded with %Characters encoded by escape()Characters encoded by encodeURI()Characters encoded by encodeURIComponent()Characters before custom tag Injection in src attribute PORT, characters that change hostname Characters appended at the end of PORT within URL, which yield a different HOST

Most popular

URL domain dot alternatives (5.4k)Characters between < and element name (4.7k)DOM element relationships (4.5k)Characters allowed between hostname and / but don't change the hostname (4.4k)Characters that can precede the javascript protocol (4.4k)Characters allowed javascript and colon (4.3k)JavaScript Scheme starting with https:// (4.3k)Characters allowed javascript and colon copy2 (4.2k)< removal bypass (4k)characters allowed between exclamation mark and greater then (3.8k)HTML entities that create ASCII characters inside a JavaScript URL (3.6k)Characters that close or encapsulate HTML attribute values (3.4k)Entities that cause an external URL before @ (3.2k)Character that closes HTML tag (3.1k)Characters allowed between multiple HTML attributes (3.1k)Characters that cause exceptions when URL encoded (3k)XSS vectors that consume tag (3k)Includes Validation Chars Allowed (3k)Characters allowed after hostname but don't change the hostname (2.8k)Tags that get reordered in the DOM (2.7k)

Most liked

URL domain dot alternatives (5)HTML entities that create ASCII characters inside a JavaScript URL (4)Characters allowed between hostname and / but don't change the hostname (4)Entities that cause an external URL before @ (4)JavaScript Scheme starting with https:// (4)Characters allowed between multiple HTML attributes (3)Characters that can precede the javascript protocol (3)Characters allowed javascript and colon (3)Characters that cause an external URL before @ (3)HTML elements that are self closing or different text content (2)Characters allowed after hostname but don't change the hostname (2)Characters allowed after optional chaining (2)Unicode characters that get normalized into path traversal characters (2)Characters that can be used as valid labels in JavaScript (2)Characters that cause exceptions when URL encoded (2)Characters that can start an HTML comment (2)Characters appended at the end of TLD within URL, which yield in the same Origin (2)Characters allowed in-between operators (2)Properties that contain URLs (2)Non-standard characters that break JSON.parse() (1)