0

I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!.

I have a url similar to the following:

http://testurl?nexturl=whatever

The nexturl parameter determines what url should be displayed after something has happened.

I'm trying to test for XSS vulnerabilities and have disabled URL filtering in my browser. I am trying to replace the whatever with something like <script>alert(1)</script> and if I view the page source code I see "nextUrl=<script>alert(1)</script>" in it. However, I do not see an alert when the "something has happened".

Is there some better piece of javaScript I can put in to the URL to see if it is executed?

1
  • Does the page get redirected to nexturl? In that case, you can try javascript:alert(1);
    – nobody
    Jun 17 '21 at 14:13
1

Since that's expecting a url (and not HTML tags), have you tried a javascript url?

javascript:alert(1)

Also, are you only testing for XSS, or would you also be interested in open redirect issues?

Legitimate sites that a user trusts with arbitrary redirects like that are great for phishing attacks!

Consider that I get an email with a link:

https://yoursite.com/account?nexturl=https://evilsite.com/passwordcollector

I use yoursite.com, I'm happy to log in and view my account! Then after interacting with it, it takes me back to the login page. Weird, I though I'd already logged in, oh well, guess I'll log in again ...

2
  • Thanks so much! I've just realised that the nexturl gets stored in a cookie. Is this still a vulnerabilty? How could an attacker exploit this?
    – NewbieSec
    Jun 18 '21 at 9:17
  • Hmm. I can't think off the top of my head how putting it in a cookie would be a problem; it depends what the server does with that cookie. Jun 18 '21 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.