Home → Questions →

Overwrite redirect url

• Edit

Jordy

10 Jun, 2015 11:14 AM

Hey,

In our project we have some urls going to a redirect script which will set a header location to the third parties site.
Now arachni does not follow the redirect which is nice. But neither it checks if the header we sent has any xss in it.

So lets say our setup is something like this:
Out

Out.php contains something like:
<?php
header('Location: ' . $_GET['out']); // Which is wrong off course but thats why we run arachni on it
?>

Now arachni seem to not check this request because it is going to a third party.
Can we somehow make sure that arachni does check the header (but still not following the redirect set in the header)

Hopefull i made the issue clear :)

Thanks in advance

1. Support Staff 1 Posted by Tasos Laskos on 10 Jun, 2015 07:12 PM

   

   Hello Jordy,

   That doesn't have an XSS, the unvalidated_redirect check should have caught it though. Did it not?

   Cheers

   • Edit

2. 2 Posted by Jordy on 11 Jun, 2015 07:19 AM

   

   Hey Tasos thanks for answering.

   Weird it seems like the header is not getting checked. I thought maybe because the redirect was pointing to an cross domain. And therefor the header does not get all the checks i hoped for.

   If you are sure then i have messed something up. I will try again.

   Cheers Tasos

   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 11 Jun, 2015 07:23 AM

   

   It's not the header that needs to be checked but the url vector. If it's seen by the unvalidated_redirect check then it should have logged the issue.

   Of course, there could be about a thousand valid reasons that you're not experiencing the expected behavior, would you mind sending me the location of the page via e-mail at: [email blocked]

   Cheers

   • Edit

4. 4 Posted by Jordy on 12 Jun, 2015 10:51 AM

   

   Hey Tasos,

   I will do some more testing to make sure it goed like i think it goed.

   Let me get back to you on this a little later

   Cheers!

   • Edit

5. Tasos Laskos closed this discussion on 30 Sep, 2015 02:56 PM.