182 lines
3.7 KiB
YAML
182 lines
3.7 KiB
YAML
id: open-redirect
|
|
|
|
info:
|
|
name: Open Redirect Detection
|
|
author: princechaddha,AmirHossein Raeisi
|
|
severity: medium
|
|
tags: redirect,dast
|
|
|
|
http:
|
|
- pre-condition:
|
|
- type: dsl
|
|
dsl:
|
|
- 'method == "GET"'
|
|
|
|
payloads:
|
|
redirect:
|
|
- "evil.com"
|
|
|
|
fuzzing:
|
|
- part: query
|
|
mode: single
|
|
keys:
|
|
- AuthState
|
|
- URL
|
|
- _url
|
|
- callback
|
|
- checkout
|
|
- checkout_url
|
|
- content
|
|
- continue
|
|
- continueTo
|
|
- counturl
|
|
- data
|
|
- dest
|
|
- dest_url
|
|
- destination
|
|
- dir
|
|
- document
|
|
- domain
|
|
- done
|
|
- download
|
|
- feed
|
|
- file
|
|
- file_name
|
|
- file_url
|
|
- folder
|
|
- folder_url
|
|
- forward
|
|
- from_url
|
|
- go
|
|
- goto
|
|
- host
|
|
- html
|
|
- http
|
|
- https
|
|
- image
|
|
- image_src
|
|
- image_url
|
|
- imageurl
|
|
- img
|
|
- img_url
|
|
- include
|
|
- langTo
|
|
- load_file
|
|
- load_url
|
|
- login_to
|
|
- login_url
|
|
- logout
|
|
- media
|
|
- navigation
|
|
- next
|
|
- next_page
|
|
- open
|
|
- out
|
|
- page
|
|
- page_url
|
|
- pageurl
|
|
- path
|
|
- picture
|
|
- port
|
|
- proxy
|
|
- r
|
|
- r2
|
|
- redir
|
|
- redirect
|
|
- redirectUri
|
|
- redirectUrl
|
|
- redirect_to
|
|
- redirect_uri
|
|
- redirect_url
|
|
- reference
|
|
- referrer
|
|
- req
|
|
- request
|
|
- ret
|
|
- retUrl
|
|
- return
|
|
- returnTo
|
|
- return_path
|
|
- return_to
|
|
- return_url
|
|
- rt
|
|
- rurl
|
|
- show
|
|
- site
|
|
- source
|
|
- src
|
|
- target
|
|
- to
|
|
- u
|
|
- uri
|
|
- url
|
|
- val
|
|
- validate
|
|
- view
|
|
- window
|
|
- back
|
|
- cgi
|
|
- follow
|
|
- home
|
|
- jump
|
|
- link
|
|
- location
|
|
- menu
|
|
- move
|
|
- nav
|
|
- orig_url
|
|
- out_url
|
|
- query
|
|
- auth
|
|
- callback_url
|
|
- confirm_url
|
|
- destination_url
|
|
- domain_url
|
|
- entry
|
|
- exit
|
|
- forward_url
|
|
- go_to
|
|
- goto_url
|
|
- home_url
|
|
- image_link
|
|
- load
|
|
- logout_url
|
|
- nav_to
|
|
- origin
|
|
- page_link
|
|
- redirect_link
|
|
- ref
|
|
- referrer_url
|
|
- return_link
|
|
- return_to_url
|
|
- source_url
|
|
- target_url
|
|
- to_url
|
|
- validate_url
|
|
- DirectTo
|
|
- relay
|
|
|
|
fuzz:
|
|
- "https://{{redirect}}"
|
|
|
|
- part: query
|
|
mode: single
|
|
values:
|
|
- "https?://" # Replace HTTP URLs with alternatives
|
|
fuzz:
|
|
- "https://{{redirect}}"
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)evil\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/idfD2e/1
|
|
|
|
- type: status
|
|
status:
|
|
- 301
|
|
- 302
|
|
- 307
|
|
# digest: 4b0a00483046022100e9bf67056b260dc2bc0f200f2d1853287f4f9b916a9a10f53fc7e643868df3200221008daacf7355ba1c40d34b672e78c096110e60601fdd1afa5932cd69b109c27d18:922c64590222798bb761d5b6d8e72950 |