Thread by @snap_sec

10 different techniques to Find and Bypass Open Redirect Vulnerabilities in Web Application.

[A Thread 🧵]

#bugbounty #bugbountytips #cybersecurity #AppSec

[1/n]

𝐖𝐡𝐚𝐭 𝐢𝐬 𝐚𝐧 𝐎𝐩𝐞𝐧 𝐑𝐞𝐝𝐢𝐫𝐞𝐜𝐭 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲?

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way.

[2/n]

𝐂𝐨𝐦𝐦𝐨𝐧 𝐏𝐥𝐚𝐜𝐞𝐬 𝐭𝐨 𝐟𝐢𝐧𝐝 𝐎𝐩𝐞𝐧 𝐑𝐞𝐝𝐫𝐢𝐜𝐭𝐢𝐨𝐧:

login
register
logout
change site language
links in emails

[3/n]

For the sake of examples Let's assume:
[webapp.nt] is vulnerable app
[attacker.ed] is attacker controlled domain

𝐁𝐚𝐬𝐢𝐜 𝐑𝐞𝐝𝐢𝐫𝐞𝐜𝐭 𝐏𝐚𝐲𝐥𝐨𝐚𝐝𝐬

http://webapp.nt?redirect=attacker.ed

This will redirect Users to attacker controlled domain("attacker.ed")

[4/n]

𝐔𝐑𝐋 𝐛𝐚𝐬𝐞𝐝 𝐫𝐞𝐝𝐢𝐫𝐞𝐜𝐭𝐢𝐨𝐧:

http://webapp.nt/http://attacker.ed
http://webapp.nt//http://attacker.ed
http://webapp.nt///http://attacker.ed

Blindly Appending attacker controlled URL may sometime lead to Open redirections.

[5/n]

𝗘𝗻𝗰𝗼𝗱𝗶𝗻𝗴 𝐝𝐨𝐭(.) :

http://webapp.nt?redirect=attacker%E3%80%82ed

- Single URL encoding or . in payload
- Double URL encoding or . in payload
- Triple URL encoding or . in payload

[6/n]

𝗨𝘀𝗶𝗻𝗴 𝗡𝘂𝗹𝗹 𝗖𝗵𝗮𝗿:

http://webapp.nt?redirect=//attacker%00.ed

Mixing Nullchars to your payload may allow you to bypass the open redirect filter at the backend.

[7/n]

𝐇𝐭𝐭𝐩 𝐏𝐚𝐫𝐚𝐦𝐞𝐭𝐞𝐫 𝐏𝐨𝐥𝐥𝐮𝐭𝐢𝐨𝐧:

Passing same parameters twice in the same request may bypass the protection:

http://webapp.nt?redirect=//attacker.ed&redirect=//attacker.ed

or
http://webapp.nt?redirect=webapp.nt&redirect=//attacker.ed

[8/n]

𝐔𝐬𝐢𝐧𝐠 @ 𝐜𝐡𝐚𝐫𝐚𝐜𝐭𝐞𝐫:

If the company is allowing Redirects only to their own site, The following payload can be useful to bypass such protections

http://webapp.nt?redirect=//[e-mail]

[9/n]

𝗨𝘀𝗶𝗻𝗴 𝗜𝗣 𝗮𝗱𝗱𝗿𝗲𝘀𝘀 𝘄𝗶𝘁𝗵 𝗗𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗡𝗼𝘁𝗮𝘁𝗶𝗼𝗻𝘀:

Try redirecting to an IP address (instead of a domain) using different notations: IPv6, IPv4 in decimal, hex or octal

[10/n]

𝗘𝗻𝗰𝗼𝗱𝗶𝗻𝗴 𝗧𝗲𝗰𝗵𝗻𝗶𝗾𝘂𝗲𝘀:

Use the following encoding techniques to encode your payload if blocked by server-side:

Url Encoded
Double Url Encoded
Hex Encoded
Mixed Encoded
base64 encoded

[11/n]

𝐇𝐓𝐓𝐏 𝐫𝐞𝐝𝐢𝐫𝐞𝐜𝐭 𝐬𝐭𝐚𝐭𝐮𝐬 𝐜𝐨𝐝𝐞𝐬:

Requests with the following Response codes maybe a indication to look for open redirect in such requests

301 Moved Permanently
302 Found
303 See Other
304 Not Modified
305 Use Proxy
307/308 Permanent/Temp Redirect