open-redirect.yaml

# info to search signature
id: Open-Redirect
type: fuzz
info:
  name: Open Redirect
  risk: Low
# jaeles scan -p 'dest=example.com' or -p 'dest=example.com' or ...
params:
  - dest: '{{.oob}}'
variables:
  - prefix: |
      http://
      https://
      //
      ///
      ///;@

  - sufix: |
      /
      ./
      /.;/
      /dummy/../
      /dummy/..;/

payloads:
  - "{{.dest}}"

requests:
  - generators:
      - Path("{{.prefix}}{{.payload}}", "*")
      - Path("{{.prefix}}{{.payload}}{{.sufix}}", "*")
      - Path("{{.payload}}", "*")
      - Query("{{.prefix}}{{.payload}}")
      - Query("{{.prefix}}{{.payload}}{{.sufix}}")
      - Query("{{.payload}}")
      - Body("{{.payload}}")

    detections:
      - >-
        RegexSearch("resHeaders", "(?m)^(L|l)ocation: {{.prefix}}{{.payload}}")
      - >-
        RegexSearch("ResBody", "(?m)<meta http-equiv="refresh".*{{.dest}} />")