Open Redirect Chains

Tags: redirect, oauth, ato, xss

Level: intermediate

Method

1. Inventory every bounce

   next, returnUrl, redirect, continue, url, dest, RelayState, successUrl. JS and 302.

   cat urls.txt | gf redirect

   Copy

   Tools: gf, gau

2. Parser matrix

   //evil, /\evil, https://target.com.evil.com, https://evil.com/https://target.com, @, backslash, javascript:, data:.

3. OAuth / next= after login

   If the bounce sits on redirect_uri or post-login next=, the code lands on you.

4. XSS sinks

   If the bounce is assigned to location or href without a scheme check, it is XSS.

Field notes

• Allowlists that use startsWith('https://target.com') lose to https://target.com.evil.com and https://target.com%00.evil.com depending on the parser.
• See the open-redirect gadget on /gadgets/ for the chain menu.

References

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect