1

I'm learning SSRF. I learnt that typing &x= kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9)

Everything that comes after the &x= part gets ignored. Why is that? Or, if it's not really ignored, then what happens?

Improve this question
1
  • "&" is just to include additional query parameters. Once the "?" is hit, the rest of the URL will be processed as GET key/value pairs.
    – pcalkins
    Aug 4, 2022 at 18:11

2 Answers 2

Reset to default
0

It's not related to encoding in this case.

According to the RFC 3986 Regular Expression of ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))? does not allow parsing of another ? after a &, which denotes a second and so forth parameter.

Improve this answer
0

The payload ending in &x= is being used to stop the remaining path from being appended to the end of the attacker's URL and instead turns it into a parameter (?x=) on the query string.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .