Limited open redirect ideas

Question

This website (example.com for confidentiality) has an odd open redirect situation. It redirects after logging in by a URL parameter like example.com/login?returnURL=https://example.com

I found that it allows you to change the redirect protocol to almost anything except a few windows protocols like mailto, so you can do something like:

example.com/login?returnURL=steam://egg.example.com

However, as in the example above, *.example.com must be immediately after the protocol or it doesn't work.

Any ideas on common protocols where I could make my own malicious link and it would redirect to it?

Answer 1

There are various ways to bypass such if it's properly validated. To know it better, you need to understand the URL architecture and how things are dine programmatically.
For example,
http://[email protected] redirects evil.com. This is because example.com in this case is username (part of authority) directly supplied in URL. You can learn more about URL architecture from https://www.rfc-editor.org/rfc/rfc3986#section-3. I'd also recommend you go through Tangled Web.
And, deoending in how it's being validated, you can also send http://evil.com?http://example.com. This also satisfies the condition that scheme is directly followed by example.com.

If you're just looking for payloads, you might find this useful;
https://github.com/cujanovic/Open-Redirect-Payloads