1

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows:

Request type: GET
Vulnerable Parameter: dest
Secondary Parameter: passrx

If I follow full method to exploit this vulnerability, then vulnerability will be exploited successfully. If I copy this URL from burpsuite and give that URL to someone else after crafting it then it wont be executed successfully as this URL also passes another parameter named passrx with unique encrypted token.

passrx=B8mzzG-GnM-hDJcYWj-0ByLGNpApDhHXQQw1WbYx7LFpG6MP60mL03oy7kVkvr21q-zlShJ38tNdUgPqQHATvb_U2IE4NzzWgqDjagHiMaxxirl583vfQ5N6Neypw7eYOyu8ihuu3tn8EGcTDPUishb6EZQ=.

The value of this parameter is unique every time. For this vulnerability no user authentication is needed. I tried couple of bypasses as follows:

  1. I removed the passrx parameter along with its value and forwarded request to the server. It gave me a 404 error page.

  2. I tried to decode the value of passrx parameter. I was unable to find any decoding algorithm and since the token is unique every time it did not help me out.

  3. I started executing whole scenario again with the help of burpsuite. When I got this request in burpsuite, I dropped the request and didn't froward to server in order to not use that unique token. I copied URL and gave to my friend who is residing in adjacent network and hoped that since token was not used, it might be executed now by my friend who is residing in an adjacent network. It also gave him a 404 error page.

Since this is a non-persistent scenario, is there any way by which I can make this persistent and able to be exploited over a remote or adjacent network?

|improve this question
  • When you intercept the request in Burp, try removing cookies before forwarding the modified request - if you get a 404 maybe it requires the cookie to be present also. You mentioned user auth is not needed, however are other cookies required? – SilverlightFox Jan 6 '15 at 8:12
  • I did not say I removed cookies. I said I removed that passrx parameter and it’s encoded value passing through get request. Cookies were there in their section. – FrOgY Jan 6 '15 at 14:27
  • I know - that's why I'm suggesting to try it. – SilverlightFox Jan 6 '15 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.