I am pentesting an API which makes a backend call to
https://example.org/ and appends any input you provide it (for example, if you provide
test it will call
https://example.org/test). I am trying to achieve SSRF in this scenario, so my goal is to change the domain. I know if it had been
https://example.org without the trailing slash, I could have done
https://firstname.lastname@example.org) or just
However, the trailing slash prevents this.
Are there any other special URL characters or techniques that can be used in this scenario to either change the domain to another site or get rid of the trailing slash?
UPDATE: The API itself is OData and internally it uses C#.