Help - Open HTTP Redirect

About

OWASP define this as:

Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

As suggested above, a common use for this is to create a URL which initially goes to the real site but then redirects the victim off to a site controlled by the attacker. This site could be a clone of the target's login page to steal credentials, a request for credit card details to pay for a service on the target site, or simply a spam page full of advertising.

---

Objective

Abuse the redirect page to move the user off the DVWA site or onto a different page on the site than expected.

---

Low Level

The redirect page has no limitations, you can redirect to anywhere you want.

Spoiler: Try browsing to /vulnerabilities/open_redirect/source/low.php?redirect=https://digi.ninja

Medium Level

The code prevents you from using absolute URLs to take the user off the site, so you can either use relative URLs to take them to other pages on the same site or a Protocol-relative URL.

Spoiler: Try browsing to /vulnerabilities/open_redirect/source/low.php?redirect=//digi.ninja

High Level

The redirect page tries to lock you to only redirect to the info.php page, but does this by checking that the URL contains "info.php".

Spoiler: Try browsing to /vulnerabilities/open_redirect/source/low.php?redirect=https://digi.ninja/?a=info.php

Impossible Level

Rather than accepting a page or URL as the redirect target, the system uses ID values to tell the redirect page where to redirect to. This ties the system down to only redirect to pages it knows about and so there is no way for an attacker to modify things to go to a page of their choosing.