There are some redirections that are easy to detect – most redirections use a GET request. Others are a little more difficult to detect in simple view and need the use of the HTTP proxy to confirm them. Let's view another example:
www.testsite.com/process.php?r=otherplace.com (moidifcar por una real)
In this kind of redirection, it is obvious that the variable is acting as flow control. Now, let's get Burp Suite to confirm the redirection and analyze it using the following steps:
- Open the website that you think is using redirections.
- Stop the request using the Burp Suite's Proxy, by clicking on the
Intercept is onbutton:
- Use the secondary click to display the options menu, and click on
Send to Spider. - Spider is a tool included in all the HTTP proxies that works to map the applications. Spider follows all the links and redirections detected in the HTTP requests and responses to find the website's structure.
- Go to the
Spidersection, clicking on theSpider...