02_Redirect and other odities.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Part II: Let's look at redirects\n",
    "\n",
    "In the `Part I` of this tutorial, we saw a simple HTTP redirect handled at the server level. It is not the only way to redirect a browser.\n",
    "\n",
    "## Redirects in the webpage\n",
    "\n",
    "### Meta refresh\n",
    "\n",
    "#### The sane one\n",
    "\n",
    "Redirects to https://example.com after 5 seconds.\n",
    "\n",
    "```html\n",
    "<head>\n",
    "  <meta http-equiv=\"refresh\" content=\"5; url=https://example.com/\">\n",
    "</head>\n",
    "```\n",
    "\n",
    "Read more on [Wikipedia](https://en.wikipedia.org/wiki/Meta_refresh).\n",
    "\n",
    "#### The less sane ones\n",
    "\n",
    "```html\n",
    "<head>\n",
    "  <meta http-equiv=\"refresh\" content=\"5; url=redirect\">\n",
    "</head>\n",
    "```\n",
    "\n",
    "```html\n",
    "<head>\n",
    "  <meta http-equiv=\"refresh\" content=\"5; url=../redirect\">\n",
    "</head>\n",
    "```\n",
    "\n",
    "```html\n",
    "<head>\n",
    "  <meta http-equiv=\"refresh\" content=\"5; url=//example.com/\">\n",
    "</head>\n",
    "```\n",
    "\n",
    "**Questions**: \n",
    "\n",
    "* What does it do if the HTML is loaded from?\n",
    "  * http://mydomain.com/\n",
    "  * https://mydomain.com/\n",
    "  * https://mydomain.com/sub_directory/\n",
    "\n",
    "**Examples**:\n",
    "\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_http\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_http_partial\n",
    "* https://rafiot.eu.pythonanywhere.com/subdir/redirect_http_path\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_http_partial_no_scheme\n",
    "* https://rafiot.eu.pythonanywhere.com/subdir/redirect_http_partial_no_slash\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/subdir/redirect_http_path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### JavaScript\n",
    "\n",
    "Redirect to https://example.com, immediately or not.\n",
    "\n",
    "#### window.location.href\n",
    "\n",
    "```html\n",
    "<script>\n",
    "  window.location.href = \"https://example.com\";\n",
    "</script>\n",
    "```\n",
    "\n",
    "\n",
    "#### With timeout\n",
    "\n",
    "```html\n",
    "<script>\n",
    "  function redirectFunc() {                                                \n",
    "    window.location.replace(\"https://example.com\");\n",
    "  }                                                                        \n",
    "  setTimeout(\"redirectFunc()\", 2000);                                      \n",
    "</script>\n",
    "```\n",
    "\n",
    "```html\n",
    "<script>\n",
    "  function redirectFunc() {                                                \n",
    "    window.location.assign(\"https://example.com\");\n",
    "  }                                                                        \n",
    "  setTimeout(\"redirectFunc()\", 2000);                                      \n",
    "</script>\n",
    "```\n",
    "\n",
    "\n",
    "#### Obfuscated\n",
    "\n",
    "```html\n",
    "    <script>\n",
    "      var _0xe753=[\"\\x68\\x74\\x74\\x70\\x73\\x3A\\x2F\\x2F\\x77\\x77\\x77\\x2E\\x79\\x6F\\x75\\x74\\x75\\x62\\x65\\x2E\\x63\\x6F\\x6D\\x2F\\x77\\x61\\x74\\x63\\x68\\x3F\\x76\\x3D\\x69\\x77\\x47\\x46\\x61\\x6C\\x54\\x52\\x48\\x44\\x41\",\"\\x61\\x73\\x73\\x69\\x67\\x6E\",\"\\x6C\\x6F\\x63\\x61\\x74\\x69\\x6F\\x6E\",\"\\x72\\x65\\x64\\x69\\x72\\x65\\x63\\x74\\x46\\x75\\x6E\\x63\\x28\\x29\"];function redirectFunc(){window[_0xe753[2]][_0xe753[1]](_0xe753[0])}setTimeout(_0xe753[3],2000)\n",
    "    </script>\n",
    "```\n",
    "\n",
    "**Question**:\n",
    "* And what about partial URLs?\n",
    "\n",
    "\n",
    "**Examples**:\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_js_loc\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_js_loc_replace\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_js_loc_assign\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_js_obfs\n",
    "* https://rafiot.eu.pythonanywhere.com/redirect_js_partial\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/redirect_js_obfs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### iFrame\n",
    "\n",
    "Load the 3rd party page within the body of your own page:\n",
    "\n",
    "```html\n",
    "<body>\n",
    "  <iframe src=\"//example.com\" frameborder=\"0\" marginheight=\"0\" marginwidth=\"0\"\n",
    "    width=\"100%\" height=\"100%\" scrolling=\"auto\"></iframe>\n",
    "</body>\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/frame"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Messing with URL Parameters\n",
    "\n",
    "A bit of everything, depending on the URL parameter..."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/url_parameter?ohai=2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/url_parameter?blah=1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl https://rafiot.eu.pythonanywhere.com/url_parameter?query=1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Task**: Describe what is going on for each URL."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Stuff fully server side (kinda)\n",
    "\n",
    "**Task**: Look at the headers in the response from the server.\n",
    "\n",
    "#### 303 redirect\n",
    "\n",
    "HTTP status code 3XX have a few different meanings, you can read more on that on [Wikipedia](https://en.wikipedia.org/wiki/URL_redirection#HTTP_status_codes_3xx).\n",
    "\n",
    "**TL;DR**: your browser is sent to an other URL than the one you tried to open.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v https://rafiot.eu.pythonanywhere.com/server_side_redirect"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### 404 with content\n",
    "\n",
    "HTTP status code 4XX means that there was an error caused by the client, you can read more on that on [Wikipedia](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_client_errors).\n",
    "\n",
    "**TL;DR**: Something happened, you get some content back, probably not what you wanted, but still a completely valid HTML response."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v https://rafiot.eu.pythonanywhere.com/missing"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Refresh header\n",
    "\n",
    "HTTP Meta tag is nice, but what about we put that content directly in the HTTP headers?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/refresh_header"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Location header\n",
    "\n",
    "... and why would be not have a location that does the same, but slightly differently? "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/location_header"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/location_header_partial"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### User agent\n",
    "\n",
    "Technique often used in websites with a mobile view, or by a malicious actor to redirect a target using a specific browser to the page containing an exploit."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/user_agent"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Task**: Try different user agents for different operating systems and see what's happening."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### IP\n",
    "\n",
    "Redirect based on the country code of the IP the request comes from. It is used very often to block a security researcher from accessing a malicious page. Or make it impossible for you to watch a video (geofencing)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/ip"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Task**: See that happens when you query the page from IPs in different countries."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Referer\n",
    "\n",
    "Often used to make sure a requests comes from a specific page. Used on banking webites to make sure the user opened the login page by clicking on a link on the front page. Also used on phishing websites to make it harder to invesigate by a security researcher."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/referer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Task**: Pass a specific referer, get redirected somewhere else."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Cookie\n",
    "\n",
    "Typically used to authentify a browser after you've been authenticated."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -v -L https://rafiot.eu.pythonanywhere.com/cookie"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Task**: Pass the right cookie and get redirected to the right place."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}