Where does next go?
Lots of apps bounce you through a URL like /app/go?next=/dashboard after an action. Point it at an internal path and it behaves:
curl -s 'http://127.0.0.1:8080/app/go?next=/dashboard'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/go?next=/dashboard' Redirecting you to /dashboard
The server sends a redirect to whatever next says. The question is whether it checks that the destination is still its own site.