open-redirect-param.yaml

id: open-param-fuzz-01
type: fuzz
level: 2
level: 4
info:
  name: Open Redirect FUZZ on Param
  risk: Medium

variables:
  - prefix: |
      http://
      https://
  - dest: |
      google.com
      example.com
  - name: |
      next
      url
      target
      to
      rurl
      return
      dest
      redirect
      destination
      redirect_uri
      redirect_url
      redir
      view
      image_url
      go
      returnTo
      return_to
      checkout_url
      continue
      return_path

payloads:
  - '{{.dest}}'
  - '/{{.dest}}'
  - '\{{.dest}}'
  - '//{{.dest}}/'
  - '\/\/{{.dest}}/'
  - '%00\/\/{{.dest}}/'
  - '/%00/{{.dest}}/'
  - '/%09/{{.dest}}/'
  - '/%0a/{{.dest}}/'
  - '/%0d/{{.dest}}/'
  - '////{{.dest}}/%2f%2e%2e'
  - '/%5c{{.dest}}/%2f%2e%2e'
  - '/〱{{.dest}}/%2f%2e%2e'
  - '@{{.dest}}'
  - '{{.prefix}}{{.dest}}'
  - '/{{.prefix}}{{.dest}}'
  - '\{{.prefix}}{{.dest}}'
  - '//{{.prefix}}{{.dest}}/'
  - '\/\/{{.prefix}}{{.dest}}/'
  - '%00\/\/{{.prefix}}{{.dest}}/'
  - '////{{.prefix}}{{.dest}}/%2f%2e%2e'
  - '/%5c{{.prefix}}{{.dest}}/%2f%2e%2e'
  - '/〱{{.prefix}}{{.dest}}/%2f%2e%2e'
  - '@{{.prefix}}{{.dest}}'

requests:
  - generators:
      - Query("{{.payload}}", "{{.name}}")
    detections:
      - >-
        (StatusCode() >= 300 && StatusCode() < 400) && RegexSearch("resHeaders", "Location:\\s(http|https?:)([\\/]+){{.dest}}") && !StringSearch("resHeaders", "Location: https://{{.Host}}")