Concealing payloads in URL credentials

Published

2024-10-23 14:03

Collected

2026-07-22 04:46

---
id: 5052
title: "Concealing payloads in URL credentials"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/concealing-payloads-in-url-credentials"
published_at: "2024-10-23 14:03"
tags: ["firefox", "web-security", "dom-xss", "credentials", "url-parsing", "clobbering"]
phying_url: "https://phying.com/item/5052"
lang: en
---

# Concealing payloads in URL credentials

## Summary

Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-10-23 14:03
- **Original:** https://portswigger.net/research/concealing-payloads-in-url-credentials
- **Phying News:** https://phying.com/item/5052