Open Redirect
Open Redirect
Introduction
Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain
Where to find
Sometimes it can be found in login / register / logout pages
Checking the javascript source code
How to exploit
Try change the domain
Using a whitelisted domain or keyword
Using
//to bypasshttpblacklisted keyword
Using
https:to bypass//blacklisted keyword
Using
\\to bypass//blacklisted keyword
Using
\/\/to bypass//blacklisted keyword
Using
%E3%80%82to bypass.blacklisted character
Using null byte
%00to bypass blacklist filter
Using parameter pollution
Using
@or%40character, browser will redirect to anything after the@
Creating folder as their domain
Using
?characted, browser will translate it to/?
Bypass the filter if it only checks for domain name using
%23
Host/Split Unicode Normalization
Using parsing
Using
°symbol to bypass
Bypass the filter if it only allows yoou to control the path using a nullbyte
%0dor%0a
References
Last updated