New crazy payloads in the URL Validation Bypass Cheat Sheet
Summary: PortSwigger Research updated its URL Validation Bypass Cheat Sheet with new IPv4 representations supported by Chrome, Firefox, and Safari, including Partial Decimal Class B and Class A formats and mixed encodings that present each IP segment in hexadecimal, decimal, or octal. The update also adds IPv6 support, special encodings such as Circled Latin letters, Fullwidth Forms, and Seven-segment display characters, and a userinfo parsing payload from @SeanPesce in which a left square bracket in the userinfo segment causes Spring's UriComponentsBuilder to return a hostname that differs from how major browsers interpret it.
What's compelling: The same cloud metadata address, 169.254.169.254, can now reach a parser in several encodings that browsers accept, so a validation check that only recognizes the dotted-quad form can be bypassed to reach internal metadata endpoints. The userinfo discrepancy between Spring's UriComponentsBuilder and major browsers can produce open redirects or SSRF.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026