$ docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:url-redirection-harder2
Now that the app is running let's go hacking!
Running the app Python3
First, make sure python3 and pip are installed on your host machine. After installation, we go to the folder of the lab we want to practise "i.e /skf-labs/XSS/, /skf-labs/jwt-secret/ " and run the following commands:
$ pip3 install -r requirements.txt
$ python3 <labname>
Now that the app is running let's go hacking!
Docker Image and write-up thanks to ContraHack!
Reconnaissance
Step 1
The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.
Intercepting the traffic generated by the application, we note that the redirection is performed using the following call
GET /redirect?newurl=newsite
that will generate a 302 Redirect response from the server
Exactly like in the previous example (KBID XXX). If we look at the code we discover a tiny difference: a blacklist!
landing_page = request.args.get('newurl')
​
if blacklist(landing_page):
return render_template("index.html", content ="Sorry, you cannot use \".\" and \"/\" in the redirect. Good luck!")
return redirect(landing_page,302)
If we look at the blacklist definition, we can immediately see that the URL, in order to be valid, must not contain any "." (dot) and "/\" (forward slash).
defblacklist(url):
blacklist =[".","/"]
for b in blacklist:
if url.find(b)!=-1:
returnTrue
returnFalse
Step 3
Let's verify the effectiveness of this blacklist. If we try to exploit the unvalidated redirect using an external website, we see that the application blocks us, returning an error in the page.
If we URL encode the dot the application is smart enough to decode it and recognise it in the URL, blocking us again.
Exploitation
Although we cannot explicitly use the dot character, we can find different ways to bypass the blacklist. In example we could use the following techniques:
double encoding: https://google%252ecom
UTF-8 encoding: https://google.com%E3%80%82com
Can you find more?
The "." (dot) blacklist bypass is done, now it's time of "\/" (forward slash).
Double encoding won't work on this case because the browser doesn't understand the URL redirection of duble encoded "/\".
With HTTPS protocol, the "\/" can be omitted. The browser will understand this URL and fix the "mistake" and will add the missing protocol double forward slashes.