Merge pull request #13 from PortSwigger/safari-special-characters-fix…

…-quot Safari allows quots as valid subdomain
PortSwigger · Sep 26, 2024 · 62d5bc7 · 62d5bc7
2 parents 1048cad + 8c14ecc
commit 62d5bc7
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/domain_allow_list_bypass.json b/src/domain_allow_list_bypass.json
@@ -106,6 +106,13 @@
             "tags": ["URL", "HOST", "CORS"],
             "id": "8314214777d8c03c8b560cf05e31b90b35a72100"
         },
+        {
+            "payload": "<allowed>.\".<attacker>",
+            "description": "Safari allows \" as subdomain http://<allowed>.\".<attacker>/",
+            "filters": [],
+            "tags": ["URL", "HOST", "CORS"],
+            "id": "3a40c89cb26a9e502030db755f0b7f5a3a0fca95"
+        },
         {
             "payload": "<allowed>.(.<attacker>",
             "description": "Safari allows ( as subdomain http://<allowed>.(.<attacker>/",