Tag Info

New answers tagged


Your question is somewhat unclear. Does the site already have Open Redirect vulnerability (https://www.owasp.org/index.php/Open_redirect)? If it does you proceed as tim already have said. If it doesn't and you are interested in general methods of getting your malicious code into its pages, then either you hack into the site ("getting shell"), or find some ...


Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...


From the information you've provided it sounds like your issue would fit in to OWASP 2013 Top 10 under "A7 - Missing Function Level Access Control" as the application should apply an access control to restrict who can see that information but appears to be failing to do so.

Top 50 recent answers are included