I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web application?
Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP content from an HTTPS website, and refreshes).
Thus, the simplest way to automate testing is to crawl/spider/monkey your web application and log all requests to other websites. Then collect all the HTTP Referers and see if there is any sensitive information being disclosed.
What you should be looking for is any sensitive data in the GET parameter of these referers (e.g. session IDs, account numbers etc.). This is a bad practice anywhere, and not just because it allows cross-domain referrer leakage, since this means that users browser histories and shared URLs are tied directly to their session/account. I've heard about this being reported generally for things like password reset (on edx and on Mozilla), where the URL allowed social media plugins to initiate "reset password", effectively giving their owners the ability to take over accounts.
Simply avoid having sensitive data in GET fields, perform all actions using POST, and use a good one-time-token for generating links to critical actions.