I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows:
Request type: GET
Vulnerable Parameter: dest
Secondary Parameter: passrx
If I follow full method to exploit this vulnerability, then vulnerability will be exploited successfully. If I copy this URL from burpsuite and give that URL to someone else after crafting it then it wont be executed successfully as this URL also passes another parameter named passrx with unique encrypted token.
passrx=B8mzzG-GnM-hDJcYWj-0ByLGNpApDhHXQQw1WbYx7LFpG6MP60mL03oy7kVkvr21q-zlShJ38tNdUgPqQHATvb_U2IE4NzzWgqDjagHiMaxxirl583vfQ5N6Neypw7eYOyu8ihuu3tn8EGcTDPUishb6EZQ=.
The value of this parameter is unique every time. For this vulnerability no user authentication is needed. I tried couple of bypasses as follows:
I removed the
passrxparameter along with its value and forwarded request to the server. It gave me a 404 error page.I tried to decode the value of
passrxparameter. I was unable to find any decoding algorithm and since the token is unique every time it did not help me out.I started executing whole scenario again with the help of burpsuite. When I got this request in burpsuite, I dropped the request and didn't froward to server in order to not use that unique token. I copied URL and gave to my friend who is residing in adjacent network and hoped that since token was not used, it might be executed now by my friend who is residing in an adjacent network. It also gave him a 404 error page.
Since this is a non-persistent scenario, is there any way by which I can make this persistent and able to be exploited over a remote or adjacent network?
