search

PortSwigger / url-cheatsheet-data

This is the data that powers the PortSwigger URL validation bypass cheat sheet.
https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
18 stars 2 forks source link

Reference localhost, avoid using :// in the protocol portion of the absolute URL #4

Closed hansmach1ne closed 3 weeks ago

hansmach1ne commented 3 weeks ago

http:/0/arbitrary
curl http:/0/arbitrary

Support for this will depend on the browser and context. Firefox will reference 0.0.0.0, while Chromium won't parse this as a valid URL. Also a lot of the server-side libraries will reference localhost here, such as curl.

d0ge commented 3 weeks ago

Thank you very much for your contribution to the URL validation bypass cheat sheet. Interestingly, when I tested this case at Chrome, it parse the string as valid URL using new URL constructor and a href, however the address bar disallow it. Other interesting observation, Chrome behaviour is different for the string http:/2130706433/arbitrary(same as https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet#id=5d2743398cd2346eb0a4008174a817498c7f685e). This issue has a lot of potential. Thank you again for your support. May I ask you to send me your handle on X.com (formerly Twitter.com)? Alternatively, I can use a link to your profile on GitHub if that’s more convenient for you.

Cheers!

hansmach1ne commented 3 weeks ago

https://x.com/h4nsmach1ne