PortSwigger Lab: Bypassing access controls using email address parsing discrepancies - DEFCON32 vuln

This is a new web hacking technique presented at DEFCON32 by a PortSwigger Researcher. I recommend you to check the research by Gareth Heyes: https://portswigger.net/research/spli... He exploit the email fields and he even achieve an RCE from the email field: Try and let me know, you can try this lab for free (All labs of PortSwigger are for free): https://portswigger.net/web-security/... HACK TIPS: 1. source routes: @example1.com,@example2.com:[email protected] .....it is not an email address, this is the principal technique to bypass this domain controls, this is source routes 2. The percent hack foo%[email protected] ...is is also used in this type of attacks 3. UUCP (Unix To Unix Copy) #wehacking #defcon32talk #bypasscontrols #bugbounty 00:00 Intro to the vulnerability 04:39 Explotation: Bypassing access controls