Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com

I found out that I can put anything I want before sub.domain.com in the continue parameter as long as sub.domain.com is present in that parameter, for example: ?continue=https://google.com-sub.domain.com.

I tried to bypass this by using a null byte (?continue=https://google.com%00sub.domain.com) and a lot of other tricks without success.

Do you have any fresh idea on how to exploit this ?


Get your own domain (I'll use attacker.com as an example). Create the subdomain sub.domain.com.attacker.com. Setup sub.domain.com.attacker.com to redirect to wherever you really want to redirect the user to. Done.

  • 1
    Or you could end the hostname part with any delimiting character like /,?,#, etc. Feb 17 '21 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.