The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Redirection Attacks

Redirection vulnerabilities arise when an application takes user-controllable

input and uses this to perform a redirection, instructing the user’s browser to

visit a different URL than the one requested. They are usually of less interest to

an attacker than cross-site scripting vulnerabilities, which can be used to per-

form a much wider range of malicious actions. Redirection bugs are primarily

of use in phishing attacks where an attacker seeks to induce a victim to visit a

spoofed web site and enter sensitive details. A redirection vulnerability can

lend credibility to the attacker’s overtures to potential victims, because it

enables him to construct a URL which points to the authentic web site he is tar-

geting, and which is therefore more convincing, but which causes anyone who

visits it to be redirected silently to a web site controlled by the attacker.

In fact, many applications actually perform redirects to third-party sites as

part of their normal function — for example, to process customer payments.

This encourages users to perceive that redirection during a transaction is not

necessarily indicative of anything suspicious. An attacker can take advantage

of this perception when exploiting redirection vulnerabilities.