id: open-redirect-generic

info:
  name: Open Redirect - Detection
  author: afaq,melbadry9,Elmahdi,pxmme1337,Regala_,andirrahmani1,geeknik
  severity: medium
  description: An open redirect vulnerability was detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-601
  metadata:
    max-request: 93
  tags: redirect,generic

http:
  - method: GET
    path:
      - "{{RootURL}}/{{redirect}}"

    payloads:
      redirect:
        - '%0a/oast.me/'
        - '%0d/oast.me/'
        - '%00/oast.me/'
        - '%09/oast.me/'
        - '%5C%5Coast.me/%252e%252e%252f'
        - '%5Coast.me'
        - '%5coast.me/%2f%2e%2e'
        - '%5c{{RootURL}}oast.me/%2f%2e%2e'
        - '../oast.me'
        - '.oast.me'
        - '/%5coast.me'
        - '////\;@oast.me'
        - '////oast.me'
        - '///oast.me'
        - '///oast.me/%2f%2e%2e'
        - '///oast.me@//'
        - '///{{RootURL}}oast.me/%2f%2e%2e'
        - '//;@oast.me'
        - '//\/oast.me/'
        - '//\@oast.me'
        - '//\oast.me'
        - '//\toast.me/'
        - '//oast.me/%2F..'
        - '//oast.me//'
        - '//%6f%61%73%74%2e%6d%65'
        - '//oast.me@//'
        - '//oast.me\toast.me/'
        - '//https://oast.me//'
        - '/<>//oast.me'
        - '/\/\/oast.me/'
        - '/\/oast.me'
        - '/\oast.me'
        - '/oast.me'
        - '/oast.me/%2F..'
        - '/oast.me/'
        - '/oast.me/..;/css'
        - '/https:oast.me'
        - '/{{RootURL}}oast.me/'
        - '/〱oast.me'
        - '/〵oast.me'
        - '/ゝoast.me'
        - '/ーoast.me'
        - '/ｰoast.me'
        - '<>//oast.me'
        - '@oast.me'
        - '@https://oast.me'
        - '\/\/oast.me/'
        - 'oast%E3%80%82me'
        - 'oast.me'
        - 'oast.me/'
        - 'oast.me//'
        - 'oast.me;@'
        - 'https%3a%2f%2foast.me%2f'
        - 'https:%0a%0doast.me'
        - 'https://%0a%0doast.me'
        - 'https://%09/oast.me'
        - 'https://%2f%2f.oast.me/'
        - 'https://%3F.oast.me/'
        - 'https://%5c%5c.oast.me/'
        - 'https://%5coast.me@'
        - 'https://%23.oast.me/'
        - 'https://.oast.me'
        - 'https://////oast.me'
        - 'https:///oast.me'
        - 'https:///oast.me/%2e%2e'
        - 'https:///oast.me/%2f%2e%2e'
        - 'https:///oast.me@oast.me/%2e%2e'
        - 'https:///oast.me@oast.me/%2f%2e%2e'
        - 'https://:80#@oast.me/'
        - 'https://:80?@oast.me/'
        - 'https://:@\@oast.me'
        - 'https://:@oast.me\@oast.me'
        - 'https://;@oast.me'
        - 'https://\toast.me/'
        - 'https://oast.me/oast.me'
        - 'https://oast.me/https://oast.me/'
        - 'https://www.\.oast.me'
        - 'https:/\/\oast.me'
        - 'https:/\oast.me'
        - 'https:/oast.me'
        - 'https:oast.me'
        - '{{RootURL}}oast.me'
        - '〱oast.me'
        - '〵oast.me'
        - 'ゝoast.me'
        - 'ーoast.me'
        - 'ｰoast.me'
        - 'redirect/oast.me'
        - 'cgi-bin/redirect.cgi?oast.me'
        - 'out?oast.me'
        - 'login?to=http://oast.me'
        - '1/_https@oast.me'
        - 'redirect?targeturl=https://oast.me'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1

      - type: status
        status:
          - 301
          - 302
          - 307
          - 308
        condition: or
# digest: 4a0a00473045022100b327ea17f154456b706a540e72c9c79e4c901a70091e38648ed261ecd5b0094502202f0ae209b845dc30c6fb92d9f33617dbca5720568776d2b1e8df2c17cb36202d:922c64590222798bb761d5b6d8e72950