Skip to content

Instantly share code, notes, and snippets.

@limdauto

limdauto/redirector.php

Created August 18, 2013 12:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save limdauto/6261460 to your computer and use it in GitHub Desktop.
Save limdauto/6261460 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
redirector.php
<?php
// Suppose attacker A cannot get a directory listing from MySite Inc. hidden JavaScript folders at http://mysite.com/hidden
// However, a cloud service B which provides JS compressing service is used by MySite Inc and therefore has accessed
// to the listing. Service B has a webpage called redirector.php which uses dynamic url input.
// Attacker A can simply use this redirector to get to the listing by accessing
// http://serviceb.com/reidrector.php?url=hidden
$redirect_url = $_GET['url'];
header("Location: http://mysite.com/" . $redirect_url);
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment