← All labs
Redirect Level 4 / 6 Hard

Path Confusion

An allowlist compares against the wrong part of the URL. Exploit the parsing gap.

Continue to your destination

This forwarder allows a redirect only if it recognises the trusted site in the target. Its parsing is sloppy — exploit that.

Must reference: uncrypt.io

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.