From 09bdd83685c085862e2e25293e13718f31774826 Mon Sep 17 00:00:00 2001 From: RelunSec Date: Thu, 18 Dec 2025 23:41:37 -0800 Subject: [PATCH 1/2] Update README with URL parsing examples Added examples of URL formats and parser behaviors. --- Server Side Request Forgery/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Server Side Request Forgery/README.md b/Server Side Request Forgery/README.md index 26bc129..98c35d1 100644 --- a/Server Side Request Forgery/README.md +++ b/Server Side Request Forgery/README.md @@ -266,6 +266,7 @@ http://127.1.1.1:80\@127.2.2.2:80/ http://127.1.1.1:80\@@127.2.2.2:80/ http://127.1.1.1:80:\@@127.2.2.2:80/ http://127.1.1.1:80#\@127.2.2.2:80/ +http:127.0.0.1/ ``` ![https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/Images/WeakParser.png?raw=true](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/Images/WeakParser.jpg?raw=true) @@ -275,6 +276,7 @@ Parsing behavior by different libraries: `http://1.1.1.1 &@2.2.2.2# @3.3.3.3/` * `urllib2` treats `1.1.1.1` as the destination * `requests` and browsers redirect to `2.2.2.2` * `urllib` resolves to `3.3.3.3` +* Some parsers replace http:127.0.0.1/ to http://127.0.0.1 ### Bypass PHP filter_var() Function From c975f61fa0cfa71ac87af5f459e5c735f6767467 Mon Sep 17 00:00:00 2001 From: RelunSec Date: Fri, 19 Dec 2025 07:48:57 -0800 Subject: [PATCH 2/2] Fix typo in README regarding URL formatting --- Server Side Request Forgery/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Server Side Request Forgery/README.md b/Server Side Request Forgery/README.md index 98c35d1..091de3b 100644 --- a/Server Side Request Forgery/README.md +++ b/Server Side Request Forgery/README.md @@ -276,7 +276,7 @@ Parsing behavior by different libraries: `http://1.1.1.1 &@2.2.2.2# @3.3.3.3/` * `urllib2` treats `1.1.1.1` as the destination * `requests` and browsers redirect to `2.2.2.2` * `urllib` resolves to `3.3.3.3` -* Some parsers replace http:127.0.0.1/ to http://127.0.0.1 +* Some parsers replace http:127.0.0.1/ to http://127.0.0.1/ ### Bypass PHP filter_var() Function