File tree Expand file tree Collapse file tree 1 file changed +2
-0
lines changed
Server Side Request Forgery Expand file tree Collapse file tree 1 file changed +2
-0
lines changed Original file line number Diff line number Diff line change @@ -266,6 +266,7 @@ http://127.1.1.1:80\@127.2.2.2:80/
266266http://127.1.1.1:80\@@127.2.2.2:80/
267267http://127.1.1.1:80:\@@127.2.2.2:80/
268268http://127.1.1.1:80#\@127.2.2.2:80/
269+ http:127.0.0.1/
269270```
270271
271272![ https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/Images/WeakParser.png?raw=true ] ( https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/Images/WeakParser.jpg?raw=true )
@@ -275,6 +276,7 @@ Parsing behavior by different libraries: `http://1.1.1.1 &@2.2.2.2# @3.3.3.3/`
275276* ` urllib2 ` treats ` 1.1.1.1 ` as the destination
276277* ` requests ` and browsers redirect to ` 2.2.2.2 `
277278* ` urllib ` resolves to ` 3.3.3.3 `
279+ * Some parsers replace http:127.0.0.1/ to http://127.0.0.1/
278280
279281### Bypass PHP filter_var() Function
280282
You can’t perform that action at this time.
0 commit comments