I have a problem. I found open redirect vulnerability by burp. Request by server look like here:
GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc
So i decided to find open redirect here, first i try this:
GET /http://google.com HTTP/1.1 Host: domain.com User-Agent: etc
Unfortunately 404 error. So i cut slash before http://google.com and bingo:
GET http://google.com HTTP/1.1 Host: domain.com User-Agent: etc Response: HTTP/1.1 302 found You are redirected to http://google.com
But i wanna exploit this vulnerability in browser, because now this bug is useless.
I can't use slash "\"(404 error) like: domain.com/http://google.com
I can't enter address without slash(domain.comhttp://google.com), cause it's not working.
Someone has any ideas to exploit this in browser?