My Pentest Log -4- (Fuzzing + Open Redirect Vulnerability)
Greetings from Constantinople to all,
In this article, I would like to tell you about the finding I found on a software I came across during web security tests.
Throughout the article, the application name will be specified as private.com
1. After the necessary explanations of our project manager, it was planned that the private.com test would be done by me.
2. As usual, I first verified the required coverage information and then rolled up my sleeves for the necessary security testing.
3. Passively and actively started the information gathering phase.
4. After the necessary research processes, I determined that the target is using plesk software. So what did that matter to us?
First of all, what is Plesk? Let’s talk a little about this:
Plesk is a commercial web hosting and server data center automation software with a control panel developed for Linux and Windows-based retail hosting service providers. — Ref : https://en.wikipedia.org/wiki/Plesk
5. I encounter plesk in many web security tests, but the nice thing for me is that some configurations do not come in the default and therefore some security vulnerabilities arise.
6. I quickly started researching the missing plesk configurations on the target application.
If you want to learn more about this, you can visit the following page:
7. At the end of the necessary research, I detected some missing configurations in the plesk software on the target, exactly as I expected. Among them, the “Open Redirect” vulnerability was the one that made me the happiest.
Attack address :
https://private.com/enterprise/rsession_init.php?failure_redirect_url=https://bgasecurity.com
Note: If you discover open redirect vulnerabilities during the tests, it will be more ethical and secure to direct the target application to the company you are in.
8. After completing the necessary exploration process, I processed the current finding into our report and continued the test from where I left off.
In summary:
* While testing the target application, try to find out which software is used on the application, maybe you can fill your report with pleasure at the end of the day.
** After detecting the software in the target application, you must take a look at the application’s guides to detect the default defects, so you can quickly detect vulnerabilities.
