I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later on. However, they do some fixed URLs they accept and respond with 400 for any other URL.

The URL the application expects looks like the following: https://subdomain.example.com/foo/bar.

I've tried to narrow down what exactly they are matching. The following attempts all failed, as the URL was not accepted.

  • Scheme: http://subdomain.example.com/foo/bar
  • Subdomain: https://foobar.example.com/foo/bar
  • Domain: https://subdomain.test.com/foo/bar
  • Directory 1: https://subdomain.example.com/bar/bar
  • Directory 2: https://subdomain.example.com/foo/foo

Furthermore I've tried to trick the application with a username in the URI: https://[email protected]/foo/bar

All in all, this seems to be very well implemented.

Q: My question is, if there are other approaches on bypassing the URL matching mechanism, I haven't thought of.


With @Trickycm's suggestions I've tried the following approaches:

  • Directory traversal: https://subdomain.example.com/foo/bar/../../../../test
  • Directory traversal: https://subdomain.example.com/../../../../test/foo/bar
  • Various encodings (e.g. URL), altering scheme, subdomain, domain, directories with each
  • Null-Byte padding
  • SQL Injections
  • Extreme length URLs
  • Various character set URLs (e.g. Chinese, Russian, Indian)
  • Various combinations of the above

None of which were successful, this seems to be implemented in a very secure manner.

  • Have you tried directory traversal ../../foo/bar etc? Or trying different encoding? e.g url encoding - %68%74%74%70%73%3a%2f%2f%73%75%62%64%6f%6d%61%69%6e%2e%65%78%61%6d%70%6c%65%2e%63%6f%6d%2f%66%6f%6f%2f%62%61%72 = subdomain.example.com/foo/bar Sep 14, 2017 at 9:27

1 Answer 1


I would try the following:

  1. directory traversal ../../foo/bar
  2. different encodings, url etc
  3. padding with null bytes and extra chars
  4. general fuzzing, including extreme length, multiple char sets and encodings, sql fuzzing (in case it is pulling the valid redirs from a db)
  • Great suggestions! Thank you very much! I've edited my question.
    – SaAtomic
    Sep 14, 2017 at 10:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .