1

I have a problem. I found open redirect vulnerability by burp. Request by server look like here:

GET /user/settings/ HTTP/1.1
Host: domain.com
User-Agent: etc 

So i decided to find open redirect here, first i try this:

GET /http://google.com HTTP/1.1
Host: domain.com
User-Agent: etc 

Unfortunately 404 error. So i cut slash before http://google.com and bingo:

GET http://google.com HTTP/1.1
Host: domain.com
User-Agent: etc 

Response:
HTTP/1.1 302 found

You are redirected to http://google.com

But i wanna exploit this vulnerability in browser, because now this bug is useless.

I can't use slash "\"(404 error) like: domain.com/http://google.com

I can't enter address without slash(domain.comhttp://google.com), cause it's not working.

Someone has any ideas to exploit this in browser?

1

You cannot exploit this vulnerability from a browser. For non-proxy requests browsers always put the absolute path into the request which means that it will start with a slash.

The request you've sent to the site is actually a HTTP proxy requests (which would in theory also be a valid HTTP/1.1 non-proxy requests, but no browser sends it this way). The browser will send such a request to the site only if the site is configured as HTTP proxy in the browser. But even if you could somehow reconfigure the users browser to use the vulnerable site domain.com as a proxy the open redirect would not work because the user would need to actually click on the real link http://google.com in order be be redirected to again http://google.com and since the user keeps using the proxy it will just end up as a endless redirect.

  • Maybe another way to use this kind of vulnerability? – ititit Aug 21 '18 at 13:55
  • @ititit: not for the vulnerability you've shown. Again, there will always be an absolute path (with a slash in front) in non-proxy HTTP requests done by the browser. – Steffen Ullrich Aug 21 '18 at 14:06
1

This is not exactly a vulnerability it is just self-exploitation in this context even changing the html on facebook is a exploit. This can only work if like you have a user on your website and you have the necessary scripts to redirect him to a malicious site.

Moreover u can use this 'trick' for phishing if you are able to get your plug in installed on your victim's computer then you can inject the json script into the requests with the required skills.

-1

You can exploit this if you can inject js to those pages.
This just redirects you, its a header, and does not fill anything to the page.

If you could find an XSS vulnerability then you could write XMLHttpRequest s that send get request to the website itself (and comply with CORS)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.