>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
Home·Academy·Topics·url parsing
Topic · 3 articles

url parsing

Intermediate level

1
With account

Open Redirect via Backslash Bypass in the OAuth Login's redirect_url

The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.

12 minopen-redirectoauthvalidation-bypass
Read article

Advanced level

2
Free

SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata

11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.

14 minssrfbypasscloud-metadata
Read article
Premium$1100

OAuth open redirect — backslash bypass of redirect_uri (POE report walkthrough)

Walkthrough of the POE report: open redirect via `\` (backslash) in redirect_uri that POE's parser didn't normalize correctly. URL-based XSS chained for token theft.

12 minoauthopen-redirectredirect-uri-bypass
Read article

Practice url parsing with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See url parsing labs
All topicsAcademy
2,482

hunters training

62

labs from real hacks

1,629

completions

$14,790

paid out for these bugs

11 flags captured this week·Real hacks from HackerOne · YesWeHack · Bugcrowd·No commitment·Free Academy
Free · no account

The checklist I run on every new target

47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.

Unsubscribe in one click, from any email.

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.

Create free accountSee the labs

No card · free Academy · cancel anytime