1

This question already has an answer here:

HTTP Request(POST):

per_page=security.stackexchange.com&order=questions&redirect=HTTP://security.stackexchange.com/

So when I record my request I get these 3 parameters and when I edited it a little bit, then click forward(Burp Suite), then I get redirected to the given site (in this case I get redirected to security.stackexchange.com).

So my questions is: Is my site vulnerable to Open Redirect? and is it a serious security vulnerability?

marked as duplicate by tim, schroeder, Gilles, Steve, Steve Dodier-Lazaro Jun 26 '15 at 1:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

If all you need to do is paste that link into the browser and you're redirected to http://security.stackexchange.com then yes it is a vulnerability.

The seriousness of the vulnerability depends on the expectations of the site and how much a user trusts it. If I can send some person a link to your site that contains a redirect to my malicious site, and they think "oh, that's important I need to click it" then its fairly serious. That redirected link can take them pretty much anywhere, which could lead to phishing, malware, etc., all the while the user thinks they're being taken to your site.

  • But it's not in browser because its POST method and I must first record requests than edit parameters to get redirected ? – rood Jun 25 '15 at 17:23
  • What happens if you take that URL verbatim and stick it in your browser so it does do a GET request? Does it take you to this site? – Steve Jun 25 '15 at 17:36
  • I tried but no, it just redirect me to own site. Maybe i don't know to convert from POST to GET – rood Jun 25 '15 at 17:50
  • @rood why do you have to record the request first? All the parameters seem static, so that shouldn't be necessary. – tim Jun 25 '15 at 18:03
  • @tim I have to, how can I change parameters values without it ? If I don't know to convert to GET(but i think it can't convert to GET because I get redirected to homepage) or I just don't have a much knowlegde about it. – rood Jun 26 '15 at 10:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.