Other nomination

Browser scheme/slash quirks

Arshan Dabirsiaghi

While defeating a product that blocked anything resembling a URL in a Location header, the author found browsers accept malformed scheme/slash forms. Internet Explorer follows http:\\google.com with backslashes, and Firefox 3 accepts http:///google.com with three slashes, in tags and redirects alike, so open-redirect filters that only match well-formed URLs fail.

Record

Researcher

Arshan Dabirsiaghi

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Tags

• open-redirect
• url-parsing
• filter-bypass
• parser-differential
• waf-bypass
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Arshan Dabirsiaghi, first published at the original source. Preserved copies are kept so the citation survives its host.