Testing for Client Side URL Redirect (OTG-CLIENT-004)

This article is part of the new OWASP Testing Guide v4.

Back to the OWASP Testing Guide v4 ToC:
   https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
Back to the OWASP Testing Guide Project:
   https://www.owasp.org/index.php/OWASP_Testing_Project

Brief Summary

aaa

Description of the Issue

aaa

code here

Black Box testing and example

Blackbox testing for XXX is not usually performed since access to the source code is always available as it needs to be sent to the client to be executed.

Gray Box testing and example

Testing for XXX vulnerabilities:
For example, looking at the following URL: XXX

The HTML code will contains the following script:

XXX

aaa

References

OWASP Resources

• DOM based XSS Prevention Cheat Sheet
• DOMXSS.com - http://www.domxss.com

Whitepapers

• Browser location/document URI/URL Sources - https://code.google.com/p/domxsswiki/wiki/LocationSources
  • i.e., what is returned when you ask the browser for things like document.URL, document.baseURI, location, location.href, etc.