Open redirect vulnerability example

What is Open Redirect Vulnerability

Healthy diet is very important for both body and mind. We want to inspire you to cook and eat healthy. If you like Aarvi Kitchen recipes, please support by sharing, subscribing and liking.

Text version of the video

Slides

ASP.NET Core Text Articles & Slides

ASP.NET Core Tutorial

Angular, JavaScript, jQuery, Dot Net & SQL Playlists

Application Vulnerable to Open Redirect Attacks

Your application is vulnerable to open redirect attacks if the following 2 conditions are true

Your application redirects to a URL that's specified via the request such as the querystring or form data

The redirection is performed without checking if the URL is a local URL

What is Open Redirect Vulnerability

The redirection includes a returnUrl querystring parameter so that the user can be returned to the originally requested URL after they have successfully logged in.

A malicious user can use this returnUrl querystring parameter to initiate an open redirect attack.

Open Redirect Vulnerability Example

The user of your application is tricked into clicking a link in an email where the returnUrl is set to the attackers website.

The login page of the attackers website looks exactly like the authentic site.

The user logs in again on the attackers website, thinking that the first login attempt was unsuccessful

The user is then redirected back to the authentic site.

During this entire process, the user does not even know his credentials are stolen.

Prevent open redirect attacks in ASP.NET Core

We have an open redirect vulnerability beacuse, the URL is supplied to the application from the querystring. We are simply redirecting to that URL without any validation which is what is making our application vulnerable to open redirect attacks.

To prevent open redirect attacks, check if the provided URL is a local URL or you are only redirecting to known trusted websites.

ASP.NET Core has built-in support for local redirection. Simply use the LocalRedirect() method. If a non-local URL is specified an exception is thrown.

public IActionResult Login(string returnUrl)
{
return LocalRedirect(returnUrl);
}

To check if the provided URL is a local URL, use IsLocalUrl() method.

public IActionResult Login(string returnUrl)
{
if (Url.IsLocalUrl(returnUrl))
{
return Redirect(returnUrl);
}
else
{
return RedirectToAction("index", "home");
}
}

[Praveen.Kumar.]

I am sure nobody explains these things in general. You are out of the box Venkat!

[foxlatinomx]

simple, clear and direct as allways, thank's man

[flygonfiasco]

Thank you for this video. I will start making sure to check return urls.

[steveclements]

Hello Venkat, thank you for this video, but my returnUrl is always NULL. I have read a lot on StackOverflow and other c# forums, but have found NO solutions. What am I doing wrong? Any ideas? Thank you!

[dhliu]

Thanks Venkat. Wish you have a nice day : )

[gabidepchai]

Help me, when I changed username and tried to log in again, I got "Invalid Login attemp". After switching back to the original username, it worked normally.

[mohdtalha]

But how can the attacker provide a link to his url while he is not even using the application?

[tregalaxy]

what programming language is being used?

[pujakriraut]

sir i have error in 71 video i can't solve this error you help me sir to solve the problem.

[Dhagand]

Can anyone help me with .net mvc web application vulnerability..I will pay if some one provide proper solution??