# Python - URL Redirection

## Running the app on Docker

```
$ docker pull blabla1337/owasp-skf-lab:url-redirection
```

```
$ docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:url-redirection
```

{% hint style="success" %}
Now that the app is running let's go hacking!
{% endhint %}

## Reconnaissance

### Step 1

The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/1.png)

If we click on the button we will be redirected on the new page <http://localhost:5000/newsite>

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/2.png)

### Step 2

Intercepting the traffic generated by the application, we note that the redirection is performed using the following call

```
GET /redirect?newurl=newsite
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/3.png)

That will generate a 302 Redirect response from the server.

Inspecting the source code, it's possible to see no input validation of *newurl* query string parameter is in place.

```python
def redirector():
    landing_page = request.args.get('newurl')
    return redirect(landing_page, 302)
```

## Exploitation

The exploitation is pretty straightforward. Replay the redirection request, but at this time change the value of *newurl* into another URL.

*Original request*

```
http://0.0.0.0:5000/redirect?newurl=newsite
```

*Modified request*

```
http://0.0.0.0:5000/redirect?newurl=https://www.google.com
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/4.png)

Using the payload above we will be able to successfully redirect a user to any website:

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/5.png)

## Additional sources

* <https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004)>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://skf.gitbook.io/asvs-write-ups/url-redirection/open-redirect.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.