ch0ic3/AllAboutBugBounty
1
0
Fork 0
mirror of https://github.com/daffainfo/AllAboutBugBounty.git synced 2024-12-18 18:36:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
5428e25125
AllAboutBugBounty/Open Redirect.md

1.1 KiB
Raw Blame History

Filter Bypass

  1. Using a whitelisted domain or keyword
target.com.evil.com
  1. Using "//" to bypass "http" blacklisted keyword
//evil.com
  1. Using "https:" to bypass "//" blacklisted keyword
https:evil.com
  1. Using "//" to bypass "//" blacklisted keyword (Browsers see // as //)
\/\/evil.com/
/\/evil.com/
  1. Using "%E3%80%82" to bypass "." blacklisted character
/?redir=evil。com
/?redir=evil%E3%80%82com
  1. Using null byte "%00" to bypass blacklist filter
//evil%00.com
  1. Using parameter pollution
?next=target.com&next=evil.com
  1. Using "@" character, browser will redirect to anything after the "@"
target.com@evil.com
target.com%40evil.com
  1. Creating folder as their domain
http://www.yoursite.com/http://www.theirsite.com/
http://www.yoursite.com/folder/www.folder.com
  1. Using "?" characted, browser will translate it to "/?"
http://www.yoursite.com?http://www.theirsite.com/
http://www.yoursite.com?folder/www.folder.com
  1. Host/Split Unicode Normalization
https://evil.c℀.example.com
  1. Using parsing
http://ⓔⓥⓘⓛ.ⓒⓞⓜ