The lab

here is how portswigger describes it

This lab contains a DOM-based open-redirection vulnerability. To solve this lab, exploit this vulnerability and redirect the victim to the exploit server.

The idea#

an open redirect is when a page takes destination from somewhere it does not really control and sends the browser there without checking it is a place it trusts. dom based just means the whole thing happens in the browser, the destination is pulled out of a client side source, here the page's own url, and fed to a client side redirect, location.href. on its own it does not steal anything, but it is a useful building block, it lets an attacker hand out a link that starts on the real, trusted site and then quietly forwards the victim anywhere, which is why it is worth flagging.

Step 1 - Read the source and understand the redirect#

no login or search again so we read the source of a blog post and the back to blog link is where it lives.

<a href='#' onclick='
returnUrl = /url=(https?:\/\/.+)/.exec(location)
location.href = returnUrl ? returnUrl[1] : "/"
'>Back to Blog</a>

the regex /url=(https?:\/\/.+)/ is run against location which is the current page's full url and it looks for the text url= followed by an http or https address, capturing that address. .exec(location) gives back the match, so returnUrl[1] is whatever address was sitting after url= in the url. then location.href = returnUrl ? returnUrl[1] : "/" says, if we found an address, send the browser to it, otherwise just go to the home page. so this link is meant to read a url= value out of the current page's address and take you back there, but it never checks that the address belongs to this site. whatever url we put after url= is where the click sends the browser and that is the open redirect.

Step 2 - Craft a URL that redirects to the exploit server#

since the link will happily send the browser to any url= value, we just put the exploit server's address there. we take a normal post url and add our own url= parameter pointing at the exploit server.

https://your-lab-id.web-security-academy.net/post?postId=4&url=https://your-exploit-server-id.exploit-server.net/

with this, the lab is solved!