The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

431

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 431

---

432

Chapter 12 

■

Attacking Other Users

Addition of an Absolute Prefix

The application may form the target of the redirect by appending the user-

controllable string to an absolute URL prefix. For example:

GET /redir.php?target=/private/admin.php HTTP/1.1

Host: wahh-app.com

HTTP/1.1 302 Object moved

Location: http://wahh-app.com/private/admin.php

In this situation, the application may or may not be vulnerable. If the prefix

used consists of 

http://

and the application’s domain name but does not

include a slash character after the domain name, then it is vulnerable. For

example, the URL

http://wahh-app.com/redir.php?target=.wahh-attacker.com

will cause a redirect to

http://wahh-app.com.wahh-attacker.com

which is under the control of the attacker, assuming that he controls the DNS

records for the domain 

wahh-attacker.com

.

If, however, the absolute URL prefix does include a trailing slash, or a sub-

directory on the server, then the application is probably not vulnerable to a

redirection attack aimed at an external domain. The best an attacker can prob-

ably achieve is to frame a URL that redirects a user to a different URL within

the same application. This attack does not normally accomplish anything,

because if the attacker is able to induce a user to visit one URL within the

application, then he can presumably just as easily feed the second URL to them

directly.

N OT E