An open redirect??? In THIS economy???

 Within the world wide web you have what are called redirections, or forwarding. Redirection is as simple as it sounds: You are browsing to a website and redirects your (or sends you) to a different site. This could be an old URL redirecting you to the new one, a url of a company directing you to the main page, or a malicious redirect. The 3rd one is what we will be discussing today. 

Generally, redirects are in the 300 HTTP status code (reference here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/300) and are either 301, 302, or 308. Depending on the website, it will require some action from the user (like logging in). 

Within the bug bounty platform open redirects are generally P4 on severity level, and so generally don't offer much in way of bounty or severity. Generally, you want to combine this with something like an XSS, SSRF, CSRF, etc to make it much higher impact, and higher bounty. But open redirects are easy to teach and understand and so they are hunted quite often. 

Open redirects happen when you are given an url and it looks like it goes to one location (like google.com) and it goes to a completely different one than expected (evilhackerwebsite.com). This is clearly a great way to phish users at a certain company, and if chained together with other vulnerabilities, can actually be quite dangerous. 

Generally, the parameter in the url that redirects to the bad website looks like *https://google.com?q=evilhackerwebsite.com". And can have various different wording as the parameter, continue, redir, url, etc. 

I personally think this is a great bug to look for not only as a first bug, but also in general because of the chaining aspect. It doesn't mean that you will automatically find an SSRF, but it could potentially lead you to that and is an interesting attack vector. 

For further resources and study I recommend checking out codingos youtube video on this and the common mistakes (one of them I made myself! lol) and to understand open redirects well before you go hunting for them! https://www.youtube.com/watch?v=84nYxHwbCpU

Cheers, and hack the planet! 

Comments

Post a Comment

Popular posts from this blog

Post SOTB and Happy New Year :)

Image
 If you missed out on SOTB that really stinks, but also I understand. Shell on the Border happened during new years and man was it an amazing experience. I couldn't attend the speaker part but the ctf was fun. It was at an arcade that had major Mr. Robot vibes. A truly different and awesome experience in the unlikely city of Fort Smith, Arkansas. Want to make a huge shout out Shyft, MoonKaptain, Fie, FractumSeraph, Allee, Fort Smith Arcade, and HackNWA (if I forgot you I am sorry it's not on purpose). All of y'all made this an amazing experience and the work we put it in was definitely seen. I am proud to be apart of FS2600 and I am grateful for the opportunity to be able to help, and to even do some of my first challenges.  I wanted to go over my challenges that I did, just 3, for those that are curious. First of all this being my first time making CTF challenges there were some mistakes on my part. I had made these challenges with a huge assumption of prerequisite knowled
Read more

Arkansas Hackers: More than meets the eye

      What do you think of when you think of Arkansas? Walmart? Bill Clinton? Barefooted hillbillies? Now, what do you think of when you think of a hacker? I am willing to bet that most of you reading this probably don't think the two go together at all. But you'll be surprised to find out that there is a large group of Cybersecurity experts and hobbyists with all kinds of interests. And so hopefully by the end of this post you will see just how expansive Arkansas Hackers is!  Last week from Friday the 6th to Sunday the 8th I had the privilege of being able to attend a popular hacking CTF that goes by the name of JOLT. For those that may not know, a hacking CTF is basically where teams of hackers come together to try and get flags that are behind challenges. These challenges are wide-ranging and cover all types of hacking areas. Other than the bragging rights there are generally rewards for the top 3 winners. JOLT is located in Little Rock, Arkansas and is headed by members of
Read more

Vulnerability Spotlight: Type confusion

What is type confusion exactly? And how can it be used to exploit programs? According to the CWE (Common Weakness Enumeration) "Type confusion is when: the program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. When the program accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access." C and C++ are common examples used because these languages do not have type checking. This allows attackers to potentially exploit type confusion within C/C++ programs, which can lead to code execution. Of course C and C++ are not the only examples, languages with dynamic typing generally (like Perl) have this issue. C++ has 3 main Cast
Read more