Hintru ENES ← Todos los labs

Avail.zone – Open Redirect / SSRF via website Parameter

EN easy bug bounty writeup Open RedirectSSRFparameter injectionURL manipulationphishingrecon

A phishing/spam email promotes a 'free partnership tool' at start.avail.zone. The invite URL passes a domain through a query parameter — what does the server actually do with it? Investigate the request flow and find an abuse path that could turn this 'invite' into something nastier.

0/5
resueltos
Paso 1 Paso 2 Paso 3 Paso 4 Paso 5
web

Paso 3 · Weaponize the Reflected Behavior for Phishing

Objetivo: Construct a weaponised invite URL that redirects a victim from the trusted avail.zone domain to an attacker-controlled page.

Contexto: Legitimate-looking links that start with a known domain (start.avail.zone) are far more convincing in phishing campaigns. If the `website` parameter causes a redirect, an attacker can abuse this from behind the trusted domain name.

Pistas progresivas

Revela solo las que necesites. Claude lleva la cuenta de cuántas usaste para calibrar la retroalimentación.

Pista 1 — empujón direccional

Think about what a victim sees in their email or chat: they hover over the link and see start.avail.zone — a domain that may appear trustworthy. What happens after they click?

Pista 2 — técnica / clase de vuln

Test whether supplying a full URL (including scheme) in the `website` parameter causes the application to redirect there, e.g. `website=https://evil.com`.

Pista 3 — casi la solución

Try the following URL and observe where your browser ends up:
https://start.avail.zone/build-connections?website=https://evil.com
Also test with `//evil.com` (protocol-relative) if the full URL is sanitised.

Tu intento