#!/usr/bin/env bash
# Vector 06: Open Redirect
# Desc: Unvalidated redirects via URL parameters
# Detect: redirect=, url=, next=, return=, goto= parameters
# Severity: MEDIUM
# Tools: curl

vector_oredir() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing Open Redirect vectors..."
  
  local redirect_params=("redirect" "url" "next" "return" "goto" "to" "dest" "destination" "target" "r" "u" "out" "view" "dir")
  local test_url="https://evil.com"
  
  for param in "${redirect_params[@]}"; do
    local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${test_url}'))" 2>/dev/null || echo "$test_url")
    local test=""
    if [[ "$target" == *\?* ]]; then
      test="${target}&${param}=${encoded}"
    else
      test="${target}?${param}=${encoded}"
    fi
    
    local redirect=$(curl -sI --connect-timeout 5 --max-time 10 "$test" 2>/dev/null | grep -i "^location:" | tr -d '\r' | sed 's/[Ll]ocation: //')
    
    if echo "$redirect" | grep -qi "evil.com"; then
      print_find "Open Redirect!" "Parameter $param redirects to external domain"
      echo "SEVERITY: MEDIUM
VECTOR: Open Redirect
DETAIL: Open redirect via parameter '$param' on $target
EVIDENCE: Redirects to $test_url
EXPLOIT: Used for phishing: $target?$param=https://phishing-site.com" > "$REPORTS_DIR/.finding_$(date +%s)_oredir.txt"
      findings=$((findings + 1))
      break
    fi
  done
  
  return $findings
}