43 lines
1.4 KiB
Bash
Executable File
43 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 06: Open Redirect
|
|
# Desc: Unvalidated redirects via URL parameters
|
|
# Detect: redirect=, url=, next=, return=, goto= parameters
|
|
# Severity: MEDIUM
|
|
# Tools: curl
|
|
|
|
vector_oredir() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing Open Redirect vectors..."
|
|
|
|
local redirect_params=("redirect" "url" "next" "return" "goto" "to" "dest" "destination" "target" "r" "u" "out" "view" "dir")
|
|
local test_url="https://evil.com"
|
|
|
|
for param in "${redirect_params[@]}"; do
|
|
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${test_url}'))" 2>/dev/null || echo "$test_url")
|
|
local test=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test="${target}&${param}=${encoded}"
|
|
else
|
|
test="${target}?${param}=${encoded}"
|
|
fi
|
|
|
|
local redirect=$(curl -sI --connect-timeout 5 --max-time 10 "$test" 2>/dev/null | grep -i "^location:" | tr -d '\r' | sed 's/[Ll]ocation: //')
|
|
|
|
if echo "$redirect" | grep -qi "evil.com"; then
|
|
print_find "Open Redirect!" "Parameter $param redirects to external domain"
|
|
echo "SEVERITY: MEDIUM
|
|
VECTOR: Open Redirect
|
|
DETAIL: Open redirect via parameter '$param' on $target
|
|
EVIDENCE: Redirects to $test_url
|
|
EXPLOIT: Used for phishing: $target?$param=https://phishing-site.com" > "$REPORTS_DIR/.finding_$(date +%s)_oredir.txt"
|
|
findings=$((findings + 1))
|
|
break
|
|
fi
|
|
done
|
|
|
|
return $findings
|
|
}
|