NodeJS - URL Redirection

Running the app nodeJs
First make sure nodejs and npm are installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following commands:
1
$ npm install
Copied!
1
$ npm start
Copied!
Now that the app is running let's go hacking!
Reconnaissance
Step 1
The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.
If we click on the button we will be redirected on the new page http://localhost:5000/newsite​
Step 2
Intercepting the traffic generated by the application, we note that the redirection is performed using the following call
1
GET /redirect?newurl=newsite
Copied!
that will generate a 302 Redirect response from the server.
Inspecting the source code, it's possible to see no input validation of newurl query string parameter is in place.
1
app.all("/redirect", (req, res) => {
2
  let newurl = req.query.newurl;
3
  res.redirect(302, newurl);
4
});
Copied!
Exploitation
The exploitation is pretty straightforward. Replay the redirection request, but at this time change the value of newurl into another URL.
Original request
1
http://localhost:5000/redirect?newurl=newsite
Copied!
Modified request
1
http://localhost:5000/redirect?newurl=https://google.com
Copied!
Using the payload above we will be able to successfully redirect a user to a malicious website
Additional sources
WSTG - v4.1 | OWASP Foundation

Python - URL Redirection

Java - URL Redirection

Last modified 2mo ago

Export as PDF

Copy link

Edit on GitHub

Contents

Running the app nodeJs

Reconnaissance

Exploitation

Additional sources