All categories
Browser Quirks
CSS Parsing
Character Encoding
DOM Behavior
Entity Parsing
HTML Parsing
JavaScript Syntax
Regular Expressions
URL Handling
XML Parsing
XSS Execution
Login
Home
Vectors
Categories
All vectors
Browser diffs
RSS
Network
Tools
Cheat sheet
Unicode table
Dynamic template
Blog
Blog home
RSS
Help
Home
Vectors
Categories
All vectors
Browser diffs
RSS
Network
Tools
Cheat sheet
Unicode table
Dynamic template
Blog
Blog home
RSS
Help
Fuzzing...
disconnected
Distributed Fuzzing
Enabled:
Status:
disconnected
Your browser automatically contributes to distributed fuzzing when idle.
All Vectors
Vector name
User
Created
Type
Likes
1
1
1
< removal bypass
Device1306
10/9/2024
HTML
0
14
14
14
Active formatting elements
JorianWoltjer
5/1/2024
XSS
0
⚠ Browser differences
125
122
125
128
All events on window
hackvertor
5/31/2024
JS
1
⚠ Browser differences
110
118
127
79
All properties on navigator (two levels of nesting deep)
freddyb
6/6/2024
JS
0
6
6
6
Allowed characters right after tag name & before tag closure, no other characters in between
hansmach1ne
1/9/2025
XSS
0
1
1
1
Attribute separators
tr3w
5/6/2024
HTML
0
⚠ Browser differences
20
20
20
10
Attributes that are also DOM properties
hackvertor
4/30/2024
XSS
0
4
4
4
4
Break out of CSS strings
hackvertor
4/4/2024
HTML
0
1
1
1
Bypass __proto__ string match defense
vitorfhc
8/29/2024
JS
0
1
1
1
Bypasses for __proto__ string match
vitorfhc
8/29/2024
JS
0
2
2
2
Bytes that will normalize ISO-2022-JP
Cillian-Collins
12/26/2024
XSS
1
2
2
2
Bytes that will scramble ISO-2022-JP
Cillian-Collins
12/26/2024
XSS
1
1
1
1
CSS inline property definition
hipotermia
3/12/2025
HTML
0
5
5
5
5
Character allowed after onerror event
InsertScript
4/2/2024
XSS
0
1
1
1
1
Character that closes HTML tag
InsertScript
4/2/2024
HTML
0
46
46
46
Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost
rootd4ddy
3/2/2025
JS
0
7
7
7
7
Characters Supported in </script> Tags
ghannu0x01
2/10/2026
XSS
0
⚠ Browser differences
12.7k
12.7k
12.7k
12.7k
Characters after https URI scheme which prevent URL parsing of href
Cillian-Collins
10/27/2025
XSS
1
16
16
16
16
Characters after strings
hackvertor
4/3/2024
JS
0
1
1
1
1
Characters allowed after * in CSS comments
hackvertor
3/31/2024
HTML
0
Found
246
records
Page 1 of 13
1
2
3
4
5
6
7
8
9
10
»