Also a great tool for bypassing corporate firewall for browsing.
Open redirects – a vulnerability class no one but attackers cares about
31–40 of 43 posts
Re: Open redirects – a vulnerability class no one but attackers cares about
#32Earlier quoted context omitted.
There is also value in customer trust. If a customer gets burned by a Google.com link, they are going to check next time they see such a link. Google would be better of if customers felt 'oh, it is Google so it must be safe'.
That might not be an issue for Google, but I could see it being a big problem for a company that relies heavily on projecting a "family friendly" image (think Disney).
Back in the day you could change some URL parameters and make it look like Toys R Us was selling firearms on their website because they used the same ecommerce back end as a sporting goods store. Like you'd go to the URL and it would be a hunting rifle (or whatever) but it would be on the Toys R Us site.
I don't think Toys R Us was ever harmed but it was mildly amusing and I'm sure a few people's panties got knotted after they found out Toys R Us doesn't actually sell firearms and they got all enraged over nothing.
Re: Open redirects – a vulnerability class no one but attackers cares about
#33Open redirects are also used to prevent referrers from propagating through. In that sense, they're very useful for anonymisation.
there are many browser extensions to spoof or disable your referrer
Re: Open redirects – a vulnerability class no one but attackers cares about
#34If you ever get a third party penetration test, this is like, the first thing they find. To say "no one but attackers cares about," is pretty nonchalant – we immediately patched up this clearly bad attack vector, despite it not being extremely likely to manifest as a serious problem to us, because, like, you should just do that.
I just fixed one myself. It's not that hard to sanitize redirect parameters. One good way, if it fits your app, is to insist they be internal-only: "/app/profile" rather than external "https://evil.example.com/phish/login"
I believe it's worth fixing these, not only because it gets penetration tests to shuddup, but because cybercreeps...
Re: Open redirects – a vulnerability class no one but attackers cares about
#35I don't think most browsers support redirect to javascript anymore. Maybe IE?
Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url).
A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.
Re: Open redirects – a vulnerability class no one but attackers cares about
#36I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
That's quite true, but I think the value in these attacks is that they work against more technical users than typical phishing attacks - I remember several years ago someone posted a link on a large technical subreddit which appeared to be to youtube.com. It presented a page which claimed to be an age flagged video - at the time youtube was having many problems with age flagging videos - and sure enough many people t…
It is interesting to note that YouTube now inserts an interstitial “you are leaving YouTube” screen on its open redirect spot.
That Reddit shows the domain name next to the link (HN also) is, I think, the key here—it casually set expectations. Most link situations won’t be like that, and so I’m broadly with tptacek, that it’s not actually so useful. Plus, businesses commonly use all sorts of different domains, rather than subdomains, and something like yourbank-security.com instead of yourbank.com may not even raise eyebrows—to say nothing of people probably not even twitching at login.yourbank.com.evil.com anyway.
Re: Open redirects – a vulnerability class no one but attackers cares about
#37I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
As a security professional I agree. When I worked at companies with bug bounties I always considered open redirects in the lamest category of bugs, unless the open redirect was cleverly combined with other issues, which was very rare.
I once worked to patch an open redirect on a system where the redirect was at the end of the oauth flow. Could have been used for some pretty nasty phishing attacks.
Re: Open redirects – a vulnerability class no one but attackers cares about
#38Is there a definitive list of attacks with prevention mechanisms somewhere ?
You might find this to be interesting and informative reading: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...
This covers what the vulnerabilities are, how they happen, how they work, and how to prevent them. It's not exhaustive, because that list would be endless, but it's one of the best resources for a web developer who is not a security practitioner.
Re: Open redirects – a vulnerability class no one but attackers cares about
#39I once reported an open redirect attack to GitHub, and they were like, nah, WONTFIX. I believe the issue still exists. That said, how useful is an open redirect attack really?
Depends on where in the system it is. If it's part of a flow involving sensitive data, an open redirect can be used to harvest that data from users. This might be anything from login credentials to bank account info, depending on what flow is involved.
Re: Open redirects – a vulnerability class no one but attackers cares about
#40I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
One other note for open redirects is that it can trick spam filters into thinking it's legit. Some filters follow links but some others do not. So you can use that as a way to improve spam scores maliciously.