Mirrors/fuzzdb
2
0
Fork 0
mirror of https://github.com/fuzzdb-project/fuzzdb.git synced 2025-02-16 08:18:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Update arbitrary redirect docs

Browse source
This commit is contained in:
Adam Muntner 2016-10-12 03:44:16 -04:00 • committed by GitHub
parent e951c9f277
commit 89c59e7d74
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
attack/redirect/README.md
View file

@ -3,14 +3,19 @@
* redirect-urls-template.txt
* URL patterns that commonly lead to open redirect. <br>
<b>Payload file Usage:</b> <br>
Replace {target} with ip or hostname and path, Examples: <br>
<b>Usage:</b> <br>
Replace {target} in files with ip or hostname and path, Examples: <br>
* evil.com <br>
* evil.com/badurl<br>
* 1.2.3.4 <br>
* 134744072<br>
<b>Filter bypass testing techniques:</b><br>
<b>Testing techniques:</b><br>
Filter Bypass
* If periods are being stripped by the filter so that evil.com becomes evilcom, try converting the ip address to decimal notation form.
http://www.geektools.com/geektools-cgi/ipconv.cgi
* Try URL-encoding the replacement value for {target}
Other Issues
* If redirect.injection.template.txt usage results in the server proxying a request to the injected URL and returning its contents instead of redirecting to it, explore how this could be used to explore the servers localhost ports for web services, protected systems in a DMZ, interact through GET requests/REST interfaces, etc.
TODO