cybersecurity · beginner · ~15 min · safe pentest lab

URL contains an @ ?

Spot the userinfo-confusion trick.

Challenge

Spot the userinfo-confusion trick where an @ hides the real host (https://trusted.com@evil.tld actually goes to evil.tld).

Task

Implement int has_at_sign(const char *url) that returns 1 if url contains an @, else 0.

Input

  • url: a NUL-terminated URL string the grader passes.

Output

Returns int: 1 if url contains @, else 0.

Example

has_at_sign("https://paypal.com@evil.tld")   ->   1
has_at_sign("https://example.com")           ->   0

Edge cases

  • Any @ anywhere in the string counts.

Rules

  • Static string only — no URL fetch or network.

Input format

A NUL-terminated URL string url.

Output format

An int: 1 if url contains @, else 0.

Constraints

Static string only — no network.

Starter code

#include <string.h>

int has_at_sign(const char *url) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.