URL validation bypass cheat sheet data

This is the data that powers the PortSwigger URL validation bypass cheat sheet. We have put this data on Github so the community can contribute vectors via pull requests.

Contributing

To contribute, please create a pull request with changes to the JSON data.

For example, to add a new payload to the domain_allow_list_bypass.json file, use the following template:

{
    "id": "d82a33ae7aa92b0f1f1f5d71a24c0f1197da4e7a",
    "payload": "<attacker>.<allowed>",
    "description": "<attacker>.<allowed>",
    "tags": ["URL", "HOST", "CORS"],
    "filters": []
}

• The id should be a sha1 hash of the payload parameters: ${prefix}${payload}${suffix}.
• The payload may include template strings <attacker> and , which will be replaced with corresponding domain names during wordlist generation.