Lab: URL normalization
Summary: This PortSwigger lab presents an XSS vulnerability that is not directly exploitable because of browser URL-encoding. Solving it requires abusing the cache's normalization process to deliver a payload that executes alert(1) in the victim's browser.
Key Takeaway: The gap between what a browser encodes and what a cache normalizes is where this payload gets through, so a cache sitting in front of your application can turn a blocked XSS into a working one.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026