绕过的姿势Web安全之url跳转漏洞及bypass总结 - 卿先生 - 博客园
- 单斜线"/"绕过
https://www.landgrey.me/redirect.php?url=/www.evil.com
- 缺少协议绕过
https://www.landgrey.me/redirect.php?url=//www.evil.com
- 多斜线"/"前缀绕过
https://www.landgrey.me/redirect.php?url=///www.evil.com
https://www.landgrey.me/redirect.php?url=////www.evil.com
- 利用"@"符号绕过
https://www.landgrey.me/redirect.php?url=https://www.landgrey.me@www.evil.com
ctfhub{e22bd4fd0dc449f1aba0be56}