# Python - URL Redirection - Harder

## Running the app on Docker

```
$ docker pull blabla1337/owasp-skf-lab:url-redirection-harder
```

```
$ docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:url-redirection-harder
```

{% hint style="success" %}
Now that the app is running let's go hacking!
{% endhint %}

## Reconnaissance

### Step 1

The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/1.png)

If we click on the button we will be redirected on the new page [http://localhost:5000/newsite](http://localhost:5000/newsite)

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/2.png)

### Step 2

Intercepting the traffic generated by the application, we note that the redirection is performed using the following call

```
GET /redirect?newurl=newsite
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/3.png)

That will generate a 302 Redirect response from the server

Exactly like in the previous example (Url. If we look at the code we discover a tiny difference: a blacklist!

```python
landing_page = request.args.get('newurl')
if blacklist(landing_page):
    return render_template("index.html", content = "Sorry, you cannot use \".\" in the redirect")
return redirect(landing_page, 302)
```

If we look at the blacklist definition, we can immediately see that the URL, in order to be valid, must not contain any "." (dot).

```python
def blacklist(url):
    blacklist = ["."]
    for b in blacklist:
        if url.find(b) != -1:
            return True

    return False
```

### Step 3

Let's verify the effectiveness of this blacklist. If we try to exploit the unvalidated redirect using an external website, we see that the application blocks us, returning an error in the page.

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/4.png)

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection-Harder/1.png)

If we URL encode the dot the application is smart enough to decode it and recognise it in the URL, blocking us again.

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection-Harder/2.png)

## Exploitation

Although we cannot explicitly use the dot character, we can find different ways to bypass the blacklist. For example we could use double encoding:

```
https://www%252egoogle%252ecom
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection-Harder/3.png)

Using the payload above we will be able to successfully redirect a user to any website:

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection-Harder/4.png)

## Additional sources

* [https://www.owasp.org/index.php/Testing\_for\_Client\_Side\_URL\_Redirect\_(OTG-CLIENT-004)](https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_\(OTG-CLIENT-004\))
