# Concealing payloads in URL credentials

DevFeed: [Concealing payloads in URL credentials](<https://devfeed.tech/articles/concealing-payloads-in-url-credentials-7671.md>)

Original publisher: [Read original article](<https://portswigger.net/research/concealing-payloads-in-url-credentials>)

Author: Gareth Heyes

Published: 2024-10-23T12:59:05Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [payload](<https://devfeed.tech/topics/payload.md>), [browsers](<https://devfeed.tech/topics/browsers.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Firefox](<https://devfeed.tech/topics/firefox.md>), [Document Object Model (DOM)](<https://devfeed.tech/topics/dom.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Fuzzing/Fuzz testing](<https://devfeed.tech/topics/fuzzing.md>), [Redirection](<https://devfeed.tech/topics/redirection.md>)

Tags: [browsers](<https://devfeed.tech/tags/browsers.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [fuzzing](<https://devfeed.tech/tags/fuzzing.md>), [payload](<https://devfeed.tech/tags/payload.md>), [redirection](<https://devfeed.tech/tags/redirection.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This article explains how payloads can be concealed in the credentials portion of URLs while remaining hidden from the address bars of Chrome and Firefox. It examines differences between document.URL and location, Firefox's handling of single quotes, and applications to DOM XSS, anchor credentials, redirection, and DOM clobbering. Safari discards URL credentials, so the described examples work only in Chrome and Firefox.

## Source excerpt

Last year Johan Carlsson discovered you could conceal payloads inside the credentials part of the URL . This was fascinating to me especially because the payload is not actually visible in the URL in