Listen to this Post
Introduction:
Subdomain redirection vulnerabilities can be goldmines for bug bounty hunters. By manipulating HTTP headers like X-Forwarded-Host, attackers (or ethical hackers) can force a server to redirect traffic to malicious domains, potentially exposing sensitive data or enabling phishing attacks. In this guide, we’ll break down how to discover and exploit these flaws using tools like ffuf, Burp Suite, and manual header injection.
Learning Objectives:
- Identify misconfigured subdomains using directory brute-forcing.
- Exploit HTTP header injection to manipulate redirections.
- Validate vulnerabilities using Burp Collaborator for DNS/HTTP callbacks.
1. Finding Hidden Directories with FFUF
Command:
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 302,200,403,401
What It Does:
`ffuf` is a fast web fuzzer that brute-forces directories and files. Here, it checks for valid paths (200), redirects (302), and access issues (401/403).
Steps:
1. Prepare a wordlist (e.g., `common.txt` from SecLists).
2. Run `ffuf` against the target subdomain.
- Analyze responses—focus on `302` redirects, which may indicate misconfigurations.
2. Intercepting Redirects with Burp Suite
Observation:
A `/logout` endpoint returns a `302` redirect. Intercepting this in Burp reveals the server’s behavior.
Exploit:
Modify the request to add:
X-Forwarded-Host: attacker.com
Impact:
If the server trusts this header, it may redirect users to attacker.com, enabling phishing or SSRF.
3. Testing for Open Redirections
Manual Test:
Replace `shodan.io` with other domains in X-Forwarded-Host. If all redirect, the vulnerability is critical.
Automated Check:
Use a list of 10+ domains to confirm universal redirection.
4. Confirming with Burp Collaborator
Steps:
1. Generate a Collaborator payload in Burp.
2. Inject it into `X-Forwarded-Host`:
X-Forwarded-Host: xyz.burpcollaborator.net
3. If the server sends HTTP/DNS callbacks, the vulnerability is confirmed.
5. Mitigation for Developers
Fix:
- Validate and sanitize all HTTP headers.
- Restrict redirections to trusted domains.
- Use allowlists for `Host` header values.
What Undercode Say:
- Key Takeaway 1: Misconfigured subdomains are low-hanging fruit for bug bounty hunters.
- Key Takeaway 2: Header injection can escalate into SSRF, phishing, or data leaks.
Analysis:
Redirection flaws often stem from overly permissive server configurations. While they may seem minor, they can chain with other vulnerabilities (e.g., OAuth token leakage via open redirects). Enterprises should audit subdomains and implement strict header validation.
Prediction:
As APIs and microservices grow, improper redirection handling will lead to more severe exploits. Automated scanning for header injection will become a standard part of penetration testing.
Final Tip: Always report findings responsibly—unauthorized testing violates most bug bounty programs’ terms. Happy hunting!
Tools Mentioned:
IT/Security Reporter URL:
Reported By: Sai Ganesh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
