Original subtitles

Now let's check out our first vulnerability open redirect, also known as unvalidated redirects and

forwards, open redirects happens when the application takes an unprecedented put and redirects the

user from the Web application to an untrusted site or resource that will be used further for malicious

purposes.

The impact of an open redirect is usually set too low unless you're using it to escalate another vulnerability

to think about open redirect as a user sharing link on Facebook and an email on SLOK, where it shows

a trusted website.

But once you click on it, it will redirect you to a malicious site controlled by an attacker.

But in a lot of cases, it may not be as straightforward as it sounds.

A lot of times developers either define a trusted or untrusted lots of resources to limit the exposure

of where you can actually direct the users to.

But if you understand how this limitation of filters work, you may be able to bypass it.

So, for example, as I mentioned earlier, you can go to example, dot com login and next page would

be Google and you go to Google.

If you put in Google dot com and that parameter, this may be allowed.

If you go to example dot com and you put an evil site where evil site as an untrusted resource that

the developers have not defined in their white listing and the application is going to clean it.

However, if you combine the two because the application is expecting to have Google somewhere in that

stream for next page, you have it after question mark or before as a subdomain and different variations

of it, you may be able to bypass those restrictions.

So as I mentioned earlier, if you have a website that says log in next page and after logging in is

going to be directed to Google dot com, that is going to be allowed.

However, if you change Google dot com to evil site where evil site is not defined in the pre submitted

whitelist and websites as a part of the filtering, it's not going to be allowed and the Web application

may come back and say, hey, this is not allowed or it was not trusted.

However, if you combine the two, if you put evil site dot com slash Google dot com or Google dot com

was a lot earlier, this may actually work because the filtering system in place is just looking for

that stream.

Google dot com.

As long as that's in that string, as long as it shows up, is going to allow the application to use

it, even though it could be invalid and it may still go to evil site dot com.

Now, let's look at this on an actual example application.