2

Open redirection how to exploit?

document.location.pathname and passed to the 'open()' function of an XMLHttpRequest object via the following statements:

url=document.location.pathname;
url=url.substr(0,trimPosition);
xhr.open(method.toUpperCase(),url,this.options.async,this.options.user,this.options.password); 

GET /cdsfsd/foo.js HTTP/1.1
Host: fo.exemple.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

Maybe it is a false vulnerability?

1

Open Redirect happens when the application takes user supplied URLs or paths as parameter value and redirect to them without warning the user.

Scenario:

Step 1: The following get request takes a URL as a parameter value.

GET /thengakola.asp?&returl=http://pappadam.com
Host: mangatholi.com

Step 2: So by sending the following link to anyone, I can fool a user who trust mangatholi.com to land on malicious website pappadam.com

http://mangatholi.com/thengakola.asp?&return=http://pappadam.com

Find out if you can device a scenario to redirect an unsuspecting user to land on another website from the link. The application is vulnerable to open redirect then.

| improve this answer | |
1

What you have doesn't look like an open redirection to me.

First, this code is doing an XMLHttpRequest or what we usually call an ajax request. XMLHttpRequest are restricted by the same origin policy and hence you will never be able to pass a malicious domain in it because the method will simply crash if it's not the same domain.

Second, you are using location.pathname. What location.pathname return you is a relative url to the current host. This means that the full url will always be {current_host}/url in your code. So, you will never access a malicious host by error.

Third, you don't have user input. Usually, open redirection vulnerability are found on login page which often contains a returnUrl as a parameter in the url to redirect the user to the right page once he logs in. If not protected, this returnUrl can be used to redirect the user to a malicious site. So, to have the vulnerability, you need to have a user input somewhere. Where is your user input?

In conclusion, I don't think that this part of the code is vulnerable to open redirection, but other part might be.

Note

The strength of open redirection vulnerability is that they use your trust in a website you know well in order to gain your trust for their malicious website. For example, if you login with google and then you are redirected to malicious_site.com, you are more likely to trust malicious_site.com as you think it's related to google even if they are completely unrelated.

| improve this answer | |
0

this is response form burp Open redirection

Data is read from document.location.pathname and passed to the 'open()' function of an XMLHttpRequest object via the following statements:

  • url=document.location.pathname;
  • url=url.substr(0,trimPosition);
    • xhr.open(method.toUpperCase(),url,this.options.async,this.options.user,this.options.password);

request 1

POST /foo/ HTTP/1.1
Host: www.foo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://foo/
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
Cookie: uid=LmWCLFiCJHMRTQbdBIvHAg==; _ga=GA1.2.1981574184.1484924024; _gat_owox=1; __exponea_etc__=c2bffa03-f562-47ec-ada4-46370f18530f; __exponea_time2__=-2.8187875747680664

form_name=service-partner

request 2

GET /fooo/foo.js HTTP/1.1
Host: www.foo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Cookie: uid=LmWCLFiCJHMRTQbdBIvHAg==; _ga=GA1.2.1981574184.1484924024; _gat_owox=1; __exponea_etc__=c2bffa03-f562-47ec-ada4-46370f18530f; __exponea_time2__=-2.8187875747680664
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.