1

Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com

I found out that I can put anything I want before sub.domain.com in the continue parameter as long as sub.domain.com is present in that parameter, for example: ?continue=https://google.com-sub.domain.com.

I tried to bypass this by using a null byte (?continue=https://google.com%00sub.domain.com) and a lot of other tricks without success.

Do you have any fresh idea on how to exploit this ?

1 Answer 1

1

Get your own domain (I'll use attacker.com as an example). Create the subdomain sub.domain.com.attacker.com. Setup sub.domain.com.attacker.com to redirect to wherever you really want to redirect the user to. Done.

1
  • 1
    Or you could end the hostname part with any delimiting character like /,?,#, etc. Commented Feb 17, 2021 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .