The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

In cases where the redirect is initiated using client-side JavaScript that

queries data from the DOM, the entire code responsible for performing the

redirect and any associated validation is typically visible on the client. This

should be closely reviewed to determine how user-controllable data is being

incorporated into the URL, whether any validation is being performed, and if so,

whether any bypasses exist to the validation. Bear in mind that as with DOM-

based XSS, some additional validation may be performed on the server prior to

the script being returned to the browser. The following JavaScript APIs may be

used to perform redirects:

■■

document.location 

■■

document.URL

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 432

---

■■

document.open() 

■■

window.location.href

■■

window.navigate()

■■

window.open()