Open Redirect

Open Redirect

Introduction

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain

Where to find

  • Sometimes it can be found in login / register / logout pages

  • Checking the javascript source code

How to exploit

  1. Try change the domain

/?redir=evil.com

  1. Using a whitelisted domain or keyword

/?redir=target.com.evil.com

  1. Using // to bypass http blacklisted keyword

/?redir=//evil.com

  1. Using https: to bypass // blacklisted keyword

/?redir=https:evil.com

  1. Using \\ to bypass // blacklisted keyword

  1. Using \/\/ to bypass // blacklisted keyword

  1. Using %E3%80%82 to bypass . blacklisted character

  1. Using null byte %00 to bypass blacklist filter

  1. Using parameter pollution

  1. Using @ or %40 character, browser will redirect to anything after the @

  1. Creating folder as their domain

  1. Using ? characted, browser will translate it to /?

  1. Bypass the filter if it only checks for domain name using %23

  1. Host/Split Unicode Normalization

  1. Using parsing

  1. Using ° symbol to bypass

  1. Bypass the filter if it only allows yoou to control the path using a nullbyte %0d or %0a

References

PreviousOn-Site Request Forgery (OSRF)NextTop 25 Open Redirect Parameters

Last updated