the-web-application-hackers-handbook

542 Chapter 13 n Attacking Users: Other Techniques
Finding and Exploiting Open Redirection Vulnerabilities
The first step in locating open redirection vulnerabilities is to identify every
instance within the application where a redirect occurs. An application can
cause the user’s browser to redirect to a different URL in several ways:
n An HTTP redirect uses a message with a 3xx status code and a Location
header specifying the target of the redirect:
HTTP/1.1 302 Object moved
Location: http://mdsec.net/updates/update29.html
n The HTTP Refresh header can be used to reload a page with an arbitrary
URL after a fixed interval, which may be 0 to trigger an immediate redirect:
HTTP/1.1 200 OK
Refresh: 0; url=http://mdsec.net/updates/update29.html
n The HTML tag can be used to replicate the behavior of any HTTP
header and therefore can be used for redirection:
HTTP/1.1 200 OK
Content-Length: 125
n Various APIs exist within JavaScript that can be used to redirect the browser
to an arbitrary URL:
HTTP/1.1 200 OK
Content-Length: 120
document.location=”http://mdsec.net/updates/update29.html”;
In each of these cases, an absolute or relative URL may be specified.