donnatello
Release Engineer
2
MONTHS
2 2 MONTHS OF SERVICE
LEVEL 1
400 XP

Hey Folks, in this tutorial we are going to talk about another web application vulnerability called “Open Redirection“. Open Redirect also known as “Unvalidated Redirects and Forwards” that allow an attacker to redirect victims from the current page to a new URL or web page, which is not the victim’s intent. These lines are really true ” Open-redirections are the low hanging fruits. If you hunt for it” because this vulnerability is rarely found in web application but being a part of web application security we will discuss about everything related to this vulnerability.
Let’s move to vulnerability

What is Open Redirection Vulnerability?
According to the OWASP : Open Redirection Vulnerability occurs when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. For Instance : In general terms we implement some basic functions in php files to redirect visitors to another web page, but sometimes we forget to check validation, causing an “open redirection” vulnerability aries . But attackers take advantage of this and redirect users or visitors to their phishing page and steal user credentials. Finding an open redirect vulnerability is no more difficult task but we should be aware of the parameters. Even sometimes it becomes very difficult to find hidden parameters and we use a crawler to find them.

Credit : owasp.org
Now we will show how the attacker does this?

Redirect To Another Website
Let’s see how we can deceived users through this vulnerability. See below we use bWAPP vulnerable application for demonstrate which you can also do from here for practice purpose. A button is given below but we have no information about what will happen after clicking on it. So lets see


As we click on the button it redirect to us to another web page. HMMM


After intercept the request we see “URL=” parameter through which the web application was redirecting us to another web page after clicking the button.

Straightforward we will replace the current URL with another URL.

Exploit


Anyone can easily understand this source code, wherein the header is tracing the URL that is inputted by the user even the server are executing the input without knowing the validation.

Basic Redirection
The exact same scenario is given below, but through this scenario you will get the idea that hyperlink may be vulnerable to open redirect vulnerability in web application and if so, how can we take advantage of it?

In this case the parameter has changed to “RedirecturL =“, but we will do the same, even we can grab some informational configuration files which is store on server side such as : config.inc, robots.txt, htaccess etc. As you can see that the following parameters are being used to redirect the user to the “portal.php” location.

As above we will change the location of the redirection and wait for the response.

Great


Base64 Redirection
Base64 is a group of binary-to-text encoding schemes that represent binary data in an ASCII string. Sometimes we see that the URL is traveling in base64 encoding which increases the level of security but while attackers also bypass it easily. How it possible let see


Got it


OMG


URL Encoded Redirection
Before moving to vulnerability, let’s first talk about this URL encoding methodology. URL encoding is a method to encode information in a Uniform Resource Identifier under certain circumstances which is also kown as Percent-encoding. For instance : https://www.secnhack.com is encoded to %20https%3A%2F%2Fwww.secnhack.com.

As we capture the request through the bupsuite tool, we see that the “Forword =” parameter has a URL encoded value.

Look at below that encoding is only applicable to special characters.

Now its time to manipulating ! we will follow the same thing and replace the URL by encoded it.

After converting the special character of the URL to the URL encoding, we replace the given URL’s.

Great:) and what do we need !! as you can see that similarly attacker can redirect us anywhere even if we do not intend to.

Similarly if the redirect URL is encoded into the hash algorithm then we have to follow the same procedure that the server is doing to redirect the victim to some other location.
Phishing with Open Redirection
Now let’s assume as prospective of an attacker right


Below just we will add our phishing page URL in “ReturnURI=” parameter.

Here it is up to you how much social engineering skills you have in relation to sending the URL to the victim. But as soon as victim will click on the link they will redirect to the phishing page.

Hurray


Mitigation
- Do not allow the URL as user input for the destination.
- Remove the redirect function from the application and replace links to it with direct link so that victim will redirect to only given locations.
- Developer Should Implement Application Security Manager (ASM) to protect users from being redirected by unvalidated redirection.
Credit : owasp.org & wikipedia.org
About the AuthorShubham Goyal Certified Ethical Hacker, information security analyst, penetration tester and researcher. Can be Contact on Linkedin.