We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#357 — Open redirect via ref parameter on /drpanel/logout.php endpoint
This issue was discovered on FirstBlood v2
On 2021-10-25, panya 
Level 7
reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Steps to reproduce:
Visit this URL: https://579a3c7897af-panya.a.firstbloodhackers.com/drpanel/logout.php?ref=/%09/google.com (works in chromium-based browsers).
Actual result:
The user will be redirected to https://google.com
Expected result:
The ref parameter should allow redirection only to relative paths.
P4 Low
Endpoint: /drpanel/logout.php
Parameter: ref
Payload: /%09/google.com
FirstBlood ID: 18
Vulnerability Type: Open Redirect
The open redirect bug on logout.php was fixed but the code still failed to filter out certain characters such as %09 and thus the endpoint is still vulnerable to open redirect. This vulnerability only affects chrome.