There is a url
abc.com/something vulnerable to open redirect to
I am catching requests at
xyz.com to see contents of requests coming to it.
When I browse
abc.com/something(being logged in to
abc.com) from a browser, then the content that I catch at
xyz.comdoesn't have any session_cookie of
Now there is a url
abc.com/path=<redirect_url>in abc.com which calls internal abc apis. So if
abc.com?path=/something/is called, then
abc.com/something. Since it is vulnerable to open redirect, so when I call it, I see the
abc.comin my request catcher at xyz.com.
So what is the difference between these two types of call? In both the cases redirection to xyz.com is happening from abc.com. Only difference is initiator of request in first its browser, in second its the server itself. In both the cases, I think it is a whitelisted(or blacklisted) domain that is making call.