Skip to content

Add scan check: open redirect detection #3

@protonese3

Description

@protonese3

Description

Add an HTTP engine check that tests for open redirect vulnerabilities. The scanner should try common redirect parameters with external URLs and check if the server follows them.

What to add

A new check function in src/engine/checks.rs that:

  1. Tries common redirect parameters: ?redirect=, ?next=, ?url=, ?return=, ?returnTo=
  2. Sets value to https://evil.com
  3. Checks if response is a 3xx redirect to that URL
  4. Creates a finding with VCVD ID VC-FE-005

Files to edit

  • src/engine/checks.rs — add check_open_redirects function
  • src/engine/mod.rs — wire it into quick_scan and full_scan

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions