Top 10 winner

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

Orange Tsai · Black Hat

URL parsers in different languages and libraries disagree about the same string, so a request validated as safe by one component is fetched as a different target by another, defeating SSRF filters. The talk chains these differences with glibc resolver quirks and Node.js Unicode handling to smuggle whole protocol payloads such as Redis commands.

Record

Researcher

Orange Tsai

Published by

Black Hat

Format

Slides

Topic

Server

In the archive

• Ranked #1 in the 2016–17 Top 10 Web Hacking Techniques

Tags

• ssrf
• parser-differential
• url-parsing
• smuggling
• filter-bypass
• unicode
• nodejs
• redis
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.