0

I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later on. However, they do some fixed URLs they accept and respond with 400 for any other URL.

The URL the application expects looks like the following: https://subdomain.example.com/foo/bar.

I've tried to narrow down what exactly they are matching. The following attempts all failed, as the URL was not accepted.

  • Scheme: http://subdomain.example.com/foo/bar
  • Subdomain: https://foobar.example.com/foo/bar
  • Domain: https://subdomain.test.com/foo/bar
  • Directory 1: https://subdomain.example.com/bar/bar
  • Directory 2: https://subdomain.example.com/foo/foo

Furthermore I've tried to trick the application with a username in the URI: https://subdomain.example.com@test.com/foo/bar

All in all, this seems to be very well implemented.

Q: My question is, if there are other approaches on bypassing the URL matching mechanism, I haven't thought of.

EDIT:

With @Trickycm's suggestions I've tried the following approaches:

  • Directory traversal: https://subdomain.example.com/foo/bar/../../../../test
  • Directory traversal: https://subdomain.example.com/../../../../test/foo/bar
  • Various encodings (e.g. URL), altering scheme, subdomain, domain, directories with each
  • Null-Byte padding
  • SQL Injections
  • Extreme length URLs
  • Various character set URLs (e.g. Chinese, Russian, Indian)
  • Various combinations of the above

None of which were successful, this seems to be implemented in a very secure manner.

SaAtomic
  • 989
  • 2
  • 15
  • 27
  • Have you tried directory traversal ../../foo/bar etc? Or trying different encoding? e.g url encoding - %68%74%74%70%73%3a%2f%2f%73%75%62%64%6f%6d%61%69%6e%2e%65%78%61%6d%70%6c%65%2e%63%6f%6d%2f%66%6f%6f%2f%62%61%72 = https://subdomain.example.com/foo/bar – TrickyDupes Sep 14 '17 at 09:27

1 Answers1

1

I would try the following:

  1. directory traversal ../../foo/bar
  2. different encodings, url etc
  3. padding with null bytes and extra chars
  4. general fuzzing, including extreme length, multiple char sets and encodings, sql fuzzing (in case it is pulling the valid redirs from a db)
TrickyDupes
  • 2,809
  • 1
  • 13
  • 27