(Open Redirection)

sangbuicom@gmail.com

It is an input validation flaw.

An application accepts an user link input
Leads to an external URL

An open redirect is an application that takes a

parameter and redirects a user to the
parameter value without any validation
Open Redirect also known as Unvalidated
Redirects and Forwards.

Platform All web platforms affected

http://www.abc.com?redirect=http://www.attacker.com

The victim that visits abc.com will be

automatically redirected to
www.attacker.com

Could be used to:

Phishing attack
Redirect a victim to the malicious page .
Steal user credentials

aotrungnien.com/redirect?url=http://lury.vn
www.applesfera.com/redirect?url=https%3A%2F%2Fitunes.
http://www.thanhnamgroup.com.vn/vi/SpecialPage/Advertis
ing.Redirect.aspx?Id=91&url=http://www.hsbc.com.vn
http://baohatinh.vn/adclick/c38199e05709bdccd256a35b94a
8da79/469?b=331&r=798&url=http://agribank.com.vn
http://nghean.vnpt.vn/modules/banner/click.php?id=59&url=
http%3A%2F%2Fsangbui.com

Moreover open redirections could also be

used to maliciously craft an URL that would
bypass the applications access control checks
and then forward the attacker to privileged
functions that they would normally not be
able to access.

Black Box testing

Gray Box testing
Tools

https://www.google.com/url?sa=t&url=http://
sangbui.com&usg=AFQjCNE4X_XBJ3kgsR7LEceasJNWqRcYw

https://www.owasp.org/index.php/Open_redirect
https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet
https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004)
https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html