open-redir | Open Redirect Vulnerability scanner | Security Testing library
kandi X-RAY | open-redir Summary
kandi X-RAY | open-redir Summary
PwnRedir is a tool designed to detect open redirects vulnerabilities on websites. It helps penetration testers and bug hunters find open redirect bugs through a scan supported by a list of payloads.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Main entry point .
- Returns a dict of Win32 calls .
- Erases the screen .
- Initialize sys . stdout and stderr .
- Prints a banner .
- Initialize the class attributes .
- Wrap the given stream .
- Context manager for context manager .
- Resets sys . stdout .
- Resets sys . stdout and stderr .
open-redir Key Features
open-redir Examples and Code Snippets
python pwnredir.py -u https://www.example.com/redirect.php?url= -f payloads.list
python pwnredir.py --url https://www.example.com/redirect.php?url= --file payloads.list
Community Discussions
Trending Discussions on open-redir
QUESTION
I am working on a RESTful web application using Go + gorilla/mux v1.4 framework. Some basic security testing after a release revealed an Open URL Redirection vulnerability in the app that allows user to submit a specially crafted request with an external URL that causes server to response with a 301 redirect.
I tested this using Burp Suite and found that any request that redirects to an external URL in the app seems to be responding with a 301 Moved Permanently. I've been looking at all possible ways to intercept these requests before the 301 is sent but this behavior seems to be baked into the net/http server implementation.
Here is the raw request sent to the server (myapp.mycompany.com:8000):
...ANSWER
Answered 2020-Mar-13 at 10:42This is not the claimed Open URL redirect security issue. This request is invalid in that the path contains an absolute URL with a different domain than the Host
header. No sane client (i.e. browser) can be lured into issuing such an invalid request in the first place and thus there is no actual attack vector.
Sure, a custom client could be created to submit such a request. But a custom client could also be made to interpret the servers response in a non-standard way or visit a malicious URL directly without even contacting your server. This means in this case the client itself would be the problem and not the servers response.
QUESTION
When ever I try to run the following Nmap Command:
nmap -sA -sV -T5 -O -A -v -Pn --script afp-brute,ajp-brute,backorifice-brute,cassandra-brute,cvs-brute,dns-brute,domcon-brute,dpap-brute,drda-brute,ftp-brute,http-adobe-coldfusion-apsa1301,http-affiliate-id,http-apache-negotiation,http-apache-server-status,http-aspnet-debug,http-auth-finder,http-auth,http-avaya-ipoffice-users,http-awstatstotals-exec,http-axis2-dir-traversal,http-backup-finder,http-barracuda-dir-traversal,http-brute,http-cakephp-version,http-chrono,http-cisco-anyconnect,http-coldfusion-subzero,http-comments-displayer,http-config-backup,http-cors,http-cross-domain-policy,http-csrf,http-date,http-default-accounts,http-devframework,http-dlink-backdoor,http-dombased-xss,http-domino-enum-passwords,http-drupal-enum-users,http-drupal-enum,http-enum,http-errors,http-exif-spider,http-favicon,http-feed,http-fetch,http-fileupload-exploiter,http-form-brute,http-form-fuzzer,http-frontpage-login,http-generator,http-git,http-gitweb-projects-enum,http-google-malware,http-grep,http-headers,http-huawei-hg5xx-vuln,http-icloud-findmyiphone,http-icloud-sendmsg,http-iis-short-name-brute,http-iis-webdav-vuln,http-internal-ip-disclosure,http-joomla-brute,http-litespeed-sourcecode-download,http-ls,http-majordomo2-dir-traversal,http-malware-host,http-mcmp,http-method-tamper,http-methods,http-mobileversion-checker,http-ntlm-info,http-open-proxy,http-open-redirect,http-passwd,http-php-version,http-phpmyadmin-dir-traversal,http-phpself-xss,http-proxy-brute,http-put,http-qnap-nas-info,http-referer-checker,http-rfi-spider,http-robots.txt,http-robtex-reverse-ip,http-robtex-shared-ns,http-server-header,http-shellshock,http-sitemap-generator,http-slowloris-check,http-slowloris,http-sql-injection,http-stored-xss,http-svn-enum,http-svn-info,http-title,http-tplink-dir-traversal,http-trace,http-traceroute,http-unsafe-output-escaping,http-useragent-tester,http-userdir-enum,http-vhosts,http-virustotal,http-vlcstreamer-ls,http-vmware-path-vuln,http-vuln-cve2006-3392,http-vuln-cve2009-3960,http-vuln-cve2010-0738,http-vuln-cve2010-2861,http-vuln-cve2011-3192,http-vuln-cve2011-3368,http-vuln-cve2012-1823,http-vuln-cve2013-0156,http-vuln-cve2013-6786,http-vuln-cve2013-7091,http-vuln-cve2014-2126,http-vuln-cve2014-2127,http-vuln-cve2014-2128,http-vuln-cve2014-2129,http-vuln-cve2014-3704,http-vuln-cve2014-8877,http-vuln-cve2015-1427,http-vuln-cve2015-1635,http-vuln-misfortune-cookie,http-vuln-wnr1000-creds,http-waf-detect,http-waf-fingerprint,http-webdav-scan,http-wordpress-brute,http-wordpress-enum,http-wordpress-users,http-xssed,iax2-brute,imap-brute,informix-brute,ip-forwarding,ip-geolocation-geoplugin,ip-geolocation-ipinfodb,ip-geolocation-map-bing,ip-geolocation-map-google,ip-geolocation-map-kml,ip-geolocation-maxmind,ip-https-discover,ipidseq,ipmi-brute,ipmi-cipher-zero,ipmi-version,ipv6-multicast-mld-list,ipv6-node-info,ipv6-ra-flood,irc-brute,irc-sasl-brute,iscsi-brute,ldap-brute,membase-brute,metasploit-msgrpc-brute,metasploit-xmlrpc-brute,mikrotik-routeros-brute,mmouse-brute,mongodb-brute,ms-sql-brute,mysql-brute,nessus-brute,nessus-xmlrpc-brute,netbus-brute,nexpose-brute,nje-node-brute,nje-pass-brute,nping-brute,omp2-brute,openvas-otp-brute,oracle-brute,oracle-sid-brute,pcanywhere-brute,pgsql-brute,pop3-brute,redis-brute,rexec-brute,rlogin-brute,rpcap-brute,rsync-brute,rtsp-url-brute,sip-brute,smb-brute,smtp-brute,snmp-brute,socks-brute,svn-brute,targets-asn,targets-ipv6-map4to6,targets-ipv6-multicast-echo,targets-ipv6-multicast-invalid-dst,targets-ipv6-multicast-mld,targets-ipv6-multicast-slaac,targets-ipv6-wordlist,targets-sniffer,targets-traceroute,targets-xml,telnet-brute,telnet-encryption,telnet-ntlm-info,traceroute-geolocation,tso-brute,unusual-port,vmauthd-brute,vnc-brute,whois-domain,whois-ip,xmpp-brute, 192.168.1.226
I get this error:
...ANSWER
Answered 2017-May-19 at 19:07This crash is caused by the trailing comma in your scripts list. An empty rule (like the one "following" that extra comma) is being interpreted as a directory with no name, which is then interpreted as the default scripts directory. Then, since some of the same scripts are chosen by name and by directory, the assertion that no 2 scripts have the same ID (basename) fails. I've corrected these problems in development, so look for them in the next release of Nmap:
- r36761: Avoid empty rules interpreted as all scripts in the script dir.
- r36762: Clarify an assertion
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install open-redir
You can use open-redir like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page