This blog is all about Cyber Security and IT

Tuesday, April 28, 2020

Open URL Redirection Vulnerability- Well Explained


What are Redirects?

Redirect means allowing a website to forward the request for the resources to another URL/endpoint. Let’s assume that you make a request to and can redirect you to another website(, so you’ll end up at even though the original request was made for This is called “redirection”. There are different types of redirects in HTTP, check em out below.

Now Lets understand this vulnerability:

Open redirect is basically what the name says, Openly allow Redirects to any website. 

URL redirection vulnerabilities found when user redirect to some other url , mainly the attacker url in unsafe way.

An attacker can construct a URL within the application that causes a redirection to an external domain. This behavior is well known for doing phishing attacks against users of the application.

Redirection Status Code - 3xx
    • 300 Multiple Choices
    • 301 Moved Permanently
    • 302 Found
    • 303 See Other
    • 304 Not Modified
    • 305 Use Proxy
    • 307 Temporary Redirect
    • 308 Permanent Redirect
      The redirection can happen on the server-side or the client side.

      Server-Side: Request to redirect is sent to the server, then the server notifies the browser to redirect to the url specified via the response.

      Client-Side: Browser is notified to redirect to the url specified directly without the intervention of the server.

      Why is this an issue?

      Think about it for a moment, what if, a TRUSTED website allows you to redirect to any other website. Then a malicious user can simply redirect to, and people fall for it all the time believing that it’s trusted, but infact, it’s not. So allowing redirects to any website without a stop in the middle or without a proper notification for the user is Bad.


      Let’s say there’s a “well known” website - And let’s assume that there’s a link like
      This link is to a sigup page, once you signup, you get redirected to which is specified in the HTTP GET Parameter redirectUrl.
      What happens if we change the to
      By visiting this url, if we get redirected to after the signup, this means we have an open redirect vulnerablility. This is a classic open redirect vulnerability.

      Why does this happen?

      This happens due to insufficient redirection checks in the back-end, which means the server is not properly checking if the redirect URL is in their whitelist or not. Here are some examples of vulnerable code

      PHP (Server-Side)

          $url_to_redirect = $_GET['redirect_url'];
          header('Location: ' . $url_to_redirect);
      Here, the php code blindly grabs the url from redirect_url parameter and redirects to that url using the Location HTTP header.

      Java (Server-Side)

      Here, a jsp page takes the url from the parameter u and blindly redirects it to the specified url.

      Javascript (Client-Side)

      window.location.href = "";
      We can assign the URL string to the location.href of window’s object. This will cause a redirect. If there are no checks inplace, then it’s a bug.

      HTML (Client-Side)

      <meta http-equiv="refresh" content="0;URL=''" />
      HTML Meta tags can refresh the site with the given url as it’s content and also you can specify the refresh delay time.

      How to find them?

      • Visit every endpoint of the target to find these “redirect” parameters.
      • View your proxy history, you might find something. Make sure to use filters.
      • Bruteforcing helps too.
      • You might uncover many endpoints by reading javascript code.
      • Google is your friend, example query: inurl:redirectUrl=http
      • Understand and analyze where the redirection is needed in the target application like redirecting to dashboard after login or something like that.

      Some tricks to find this bugs

      • Test for basic modification of the url like
      • Try with double forward slashes
      • Try In this case the interpretation will be like, the is the username and will be the domain.
      • Test for javascript Protocol javascript:confirm(1).
      • Try if there’s an image resource being loaded.
      • Try IP address instead of the domain name.
      • You can go further in terms of representing the IP in decimal, hex or octal.
      • You can also try to bypass weak regex implementations.
      • Chinese seperator 。 as the dot - https://attacker%E3%80%82com.
      • Test for String reverser unicode(“\u202e”)
      • No slashes
      • Back slashes http:/\/\ or https:/\
      • Different domain resulting in redirection of which is not the same as
      • Try some unicode(including emojis) madness t𝐀 or 𝐀‘𝐀’ is “\uD835\uDC00”).



      Assume that the target is It has a password recovery page at You enter the email and you click on Forgot Password button, and it’ll send you an email with a password reset link, and this link might look like
      If we tamper with the redirect parameter and change it to
      This redirects the user to an evil login page instead if the original one and the user can be phished.


      • Only use redirects if you really want em.
      • If you want to use them, make sure you properly check the whitelisted domains and allow the matched ones.


      Post a Comment