> For the complete documentation index, see [llms.txt](https://yasmeen-rezk.gitbook.io/my-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yasmeen-rezk.gitbook.io/my-notes/bug-bounty-playbook-v2/more-owasp/rpo.md).

# RPO

Relative Path Overwrite

### <mark style="color:yellow;">Basic Concepts</mark>

#### Ways an application can load the CSS file

```html
<!-- using the full path to the CSS file  -->
<link   href="http://example.com/style.css"   rel="stylesheet"   type="text/css"/>

<!-- using root dir of the CSS file -->
<link   href="/style.css"   rel="stylesheet"   type="text/css"/>

<!--  using a relative path  -->
<link   href="style.css"   rel="stylesheet"   type="text/css"/>
```

#### Quirks mode

Handles the poorly coded websites.

If quirks mode is enabled the browser will ignore the “content-type” of a file when processing it.

* EX: parsing the HTML file as if it's a CSS file.

### <mark style="color:yellow;">Exploitation RPO</mark>

#### Prerequisites

Meet all the following requirements to exploit RPO.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FBQFOGwLaSX74E3BXxhcd%2Fimage.png?alt=media&amp;token=b2af8eee-9e89-4f3b-b32c-78b9fe7a9319" alt=""><figcaption></figcaption></figure>

#### Vulnerable Code Snippet

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FX2kvq3K6r2lNTTiWEJAN%2Fimage.png?alt=media&amp;token=d1d03e67-e89c-4b49-8dd7-c075e7935679" alt=""><figcaption></figcaption></figure>

**Meeting requirements:**

{% tabs %}
{% tab title="¯\_(ツ)\_/¯" %}
Swap Tabs
{% endtab %}

{% tab title="Path reflection" %}
The “okay/” path is displayed on the page.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FvAVaxmi2W9KgJMrBgjRS%2Fimage.png?alt=media&amp;token=4a417273-8aa8-4d3a-8e99-d2c2877c20a9" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Quirks mode" %}
The “document type” tag is missing from the HTML source.

{% endtab %}

{% tab title="Wildcard path" %}
The “/home/okay/” resolves to the same page as “/home”.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2Fhy97i3zJKovqohw7wEAU%2Fimage.png?alt=media&amp;token=668298f0-2cba-49d3-b5f3-40baf564c492" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Relative Path" %}
When changing the URL to “/home/okay/”, the “Link” tag tries to import its stylesheet from “/home/okay.style.css”

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FeWCaknEGc2WD2f3RRZtb%2Fimage.png?alt=media&amp;token=97afee0e-d9b4-480e-95a4-1cdc74361b28" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

#### After meeting all requirements, try to inject CSS code to turn the font red so we now know the target is vulnerable:

EX: <mark style="color:red;">%0A{}\*{color:red;}///</mark>

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FeuZx7ZTMgGaWgCiFM20B%2Fimage.png?alt=media&amp;token=e6e6f26c-1032-4eae-9623-023f34cf9d71" alt=""><figcaption></figcaption></figure>

### <mark style="color:yellow;">Impact</mark>

Low severity finding.

* XSS, web defacement, and extracting sensitive data.