Topic · 3 articles

url parsing

Intermediate level

Open Redirect via Backslash Bypass in the OAuth Login's redirect_url

The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.

12 minopen-redirectoauthvalidation-bypass

Read article

Advanced level

Free

SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata

11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.

14 minssrfbypasscloud-metadata

Read article

Premium$1100

OAuth open redirect — backslash bypass of redirect_uri (POE report walkthrough)

Walkthrough of the POE report: open redirect via `\` (backslash) in redirect_uri that POE's parser didn't normalize correctly. URL-based XSS chained for token theft.

12 minoauthopen-redirectredirect-uri-bypass

Read article

Practice url parsing with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See url parsing labs

All topics Academy

hunters training: 711
labs from real reports: 55
completions: 1,205
in bounties practiced: $213,970

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime